---
title: "How to Allow Cracked Players on a Minecraft Server"
description: "Ultimate 2026 guide to enabling cracked/offline mode on your Minecraft server. Fix inventory and UUID bugs, protect LuckPerms ranks, set up AuthMe, and configure GeyserMC / Floodgate."
category: jeux
subcategory: minecraft-java
icon: tabler:file-text
date: 2026-07-24
author: Winheberg
slug: "allow-cracked-players-minecraft-server"
order: 60
image: /statics/images/docs/en/gaming/minecraft-java/allow-cracked-players-minecraft-server.webp
tags: [minecraft, configuration, server, security, plugins, geysermc, gaming-panel]
keywords: [allow cracked players minecraft, minecraft offline mode, online-mode false setup, secure cracked minecraft server, offline uuid minecraft, authme reloaded 2026, geysermc cracked floodgate, skinsrestorer tutorial, winheberg minecraft server]
link_fr: "/docs/minecraft-java/autoriser-crack-serveur-minecraft"
---
## Context
By default, a Minecraft server runs in online mode (`online-mode=true`). In this configuration, the server queries the official Mojang/Microsoft authentication services on every connection, and refuses access to any player whose session is not validated by the official servers.
To allow players using an unofficial version, known as cracked, you need to switch your server to offline mode (`online-mode=false`). This same configuration also serves as the technical foundation for networks behind a proxy (BungeeCord, Velocity). It removes the game's native identity check, which opens access to all clients but exposes your server as long as it is not secured. This guide explains how to enable it cleanly on your Winheberg server, protect administrator access and preserve your players' data.
## Prerequisites
- An active Minecraft Java server (Spigot, Paper or Purpur) on your Winheberg gaming panel
- Access to your server file manager
- A recent backup, essential before changing how players are identified
> [!CAUTION]
> Enabling `online-mode=false` on a server already used in official mode changes the technical identity of your players. Make a full backup through the `Backups` tab before continuing, because our team cannot restore data that was never backed up.
## 1. Disable the official check (server.properties)
This change is made in your server's main configuration file.
1. Log in to your Winheberg gaming panel at `https://panel.winheberg.com/`
2. Stop your server before editing the files, to avoid any overwrite on restart
3. Open the `File manager` tab
4. Locate and open the `server.properties` file
5. Look for the network authentication line
```properties
online-mode=true
```
6. Change the value to `false`
```properties
online-mode=false
```
7. Save with the save button or the Ctrl + S shortcut
## 2. Secure administrator access (mandatory)
> [!CAUTION]
> As soon as `online-mode=false` is active, your server no longer controls account identity. A malicious user can rename themselves to match your username or a moderator's exactly, then connect with your administrator privileges (OP). Setting up local authentication is therefore not optional.
On Spigot, Paper or Purpur architectures, a local authentication gateway is required.
### Option A, password with AuthMeReloaded
This is the most proven method to secure a player base in offline mode. Download AuthMeReloaded from its official page (SpigotMC) and drop the `.jar` file into your server's `/plugins/` folder, then restart to generate its configuration.
On the first connection, the server freezes the player and requests a password.
```text
/register
```
On later sessions, the player authenticates to unlock their inventory and interactions.
```text
/login
```
### Option B, hybrid login with FastLogin
To improve the experience for official accounts, add FastLogin (available on SpigotMC). The plugin detects whether the player connects from an official client. In that case, it validates the session in the background without asking for a password. If the player uses an unofficial launcher, FastLogin automatically falls back to AuthMeReloaded's local authentication.
## 3. Understanding the UUID trap (inventories and permissions)
This is the most common mistake when switching to offline mode. Each player is identified by a unique string called a UUID, and the source of that UUID changes depending on the mode.
In online mode, the UUID is provided by Mojang. In offline mode, it is computed locally from the player's username. These two UUIDs are different for the same player.
> [!IMPORTANT]
> If your server was running in official mode and you switch it to offline mode, the server generates a new UUID for each player. Inventories, enderchests and ranks tied to the old UUID are then no longer recognized, which appears as data loss.
### Preserving inventories
Player data is stored in `/world/playerdata/` as `.dat` files named after the UUID. To keep an inventory after the mode change, rename the `.dat` file of the old official UUID with the player's new offline UUID. Always work on a backup copy, since a renaming mistake can make the data unreadable.
### Preserving permissions
LuckPerms and most plugins also identify players by UUID. The same UUID change therefore affects assigned groups and permissions. After switching to offline mode, reassign groups to the affected players. For a network behind a proxy, set up IP forwarding so the backend servers receive a consistent UUID, which avoids this mismatch.
## 4. Restore skin display
In offline mode, clients no longer load appearance textures from Mojang's servers, and all players show up as Steve or Alex by default.
> [!TIP]
> To give your players a visual identity back, install the free SkinsRestorer plugin (available on Modrinth or SpigotMC) into your `/plugins/` folder.
Once configured, SkinsRestorer lets each player apply the skin of their choice through a command.
```text
/skin
```
## 5. Bedrock compatibility (GeyserMC and Floodgate)
If you use Geyser to welcome players on mobile, console and Windows to your Java server, offline mode needs special attention, because Bedrock players do not have an official Java account.
1. Download the tools from the official GeyserMC page (`https://geysermc.org/download`) and install Floodgate alongside GeyserMC
2. Open Floodgate's `config.yml` file
3. Floodgate adds a prefix by default (the `.` character) in front of Bedrock player names, which avoids username conflicts with Java players. You can adjust this prefix in the configuration
## Special case, server networks (BungeeCord and Velocity)
> [!IMPORTANT]
> On a network, `online-mode=false` applies only to the final game servers (Spigot, Paper). The proxy (BungeeCord or Velocity) handles authentication on its own, and IP forwarding must be enabled between the proxy and the backend servers. A final game server in offline mode must never be reachable directly from the outside without protection, otherwise the proxy can be bypassed.
## Troubleshooting
### ❌ The "Invalid Session" message appears after the change
- The server was probably not fully restarted after editing `server.properties`
- Fully stop the instance from the panel, check the `online-mode=false` line, then restart
- Make sure no duplicate `online-mode` line remains in the file
### ❌ Some players lost their inventory or ranks
- The UUID change is the most likely cause, since the old identifier is no longer recognized
- Restore inventories by renaming the `.dat` files in `/world/playerdata/` to the new UUIDs
- Reassign permission groups to the affected players through LuckPerms
### ❌ All players appear as Steve or Alex
- This is normal behavior in offline mode, since textures are no longer loaded from Mojang
- Install and configure SkinsRestorer to restore skins
- Ask players to apply their skin with the `/skin` command
## Best practices
- Make a backup through the `Backups` tab before changing the authentication mode
- Install local authentication such as AuthMeReloaded before opening the server to the public
- Avoid offline mode on a pure Vanilla server, without an access protection plugin
- On a network, keep IP forwarding active to maintain consistent UUIDs across servers
- Protect your final game servers behind a firewall to prevent any direct access
- Test the authentication chain on a secondary account before announcing the opening
## Need help?
If you notice reconnection anomalies or file write conflicts on your instances, our support team is here to analyze your logs. Open a ticket in the **Technique** department, set the relevant server in the **Related Product** field, and our team will assist you.
A controlled opening means a welcoming and well-protected server 🔒