Direct answer

On a standalone Minecraft Java server, online-mode=true makes the server authenticate connecting players against Minecraft's account system. Setting online-mode=false disables that account check, which is why clients commonly described as cracked or offline-mode clients can connect.

online-mode=false

After changing server.properties, perform a full server restart. MSH strongly recommends using legitimate Minecraft accounts and keeping a normal public server in online mode.

Why MSH does not recommend cracked clients

Cracked launchers and unofficial game distributions do not have the same trusted distribution path as the official Minecraft launcher. Their safety varies, and security vendors have documented cracked launchers that bundle potentially unwanted programs, adware, or malware. That does not mean every unofficial launcher is malicious, but it means players are accepting additional provenance and security risk.

MSH does not provide cracked launcher downloads or instructions for obtaining pirated copies. If you want to play with friends, the safer option is for every player to use a legitimate account and a trusted launcher.

What you lose when online-mode is false

Disabling authentication changes the server's trust model. The server can no longer rely on Mojang/Microsoft authentication to prove that the person using a username actually owns that account.

  • Another client can attempt to join using someone else's username.
  • Offline-mode UUID handling differs from authenticated UUIDs, so inventories, permissions, claims, or other player data can appear under different identities when switching modes.
  • Skins and profile information may not behave like a normal authenticated server unless another trusted system supplies them.
  • A public offline-mode server needs additional identity/security measures because a normal whitelist alone does not restore account authentication.

If this is a small private server

If you still choose to run a private offline-mode server, keep it private, take a backup before changing identity mode, and do not assume OP or whitelist entries are sufficient protection against username impersonation. Avoid exposing administrative services such as RCON, panels, or backend ports unnecessarily.

If the reason is only that Minecraft's authentication service is temporarily unavailable, do not permanently disable authentication as a workaround. Restore normal authenticated access when the service is available.

Proxy networks are different

A correctly configured proxy network can intentionally use online-mode=false on its backend servers because the proxy performs authentication. For example, Velocity's documented setup places backends in offline mode and then requires secure player information forwarding and backend protection.

Do not copy this pattern to a public standalone server.A backend in offline mode must not be directly reachable by untrusted players, or they may bypass the proxy's authentication and forwarding.

How to return to authenticated mode

Stop the server, back it up, set online-mode=true, and restart. If the server has already been used in offline mode, plan the change as an identity migration: authenticated UUIDs can differ from offline-mode UUIDs, which can affect inventories, permissions, homes, claims, and plugin data.

References

These sources were checked while preparing this article. Version-specific behavior can change, so use the documentation for your exact server and client versions when details differ.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000