Updated:
What online-mode does
online-mode in server.properties makes the server ask Microsoft's authentication servers whether each player owns a real Minecraft account.
| Value | Behavior |
|---|---|
true (default) | Only verified accounts can join |
false | No check; the server trusts whatever name is entered |
What happens with false
Anyone can use any name
Without verification, a player can join as someone else. Joining as an operator gives them that operator's commands, so destroying the world or taking items is easy.
The whitelist stops protecting you
The whitelist checks names. With online mode off, names can be faked, so anyone can claim a whitelisted name. A whitelist alone is not enough.
Players get different UUIDs
The server tells players apart by UUID. With online mode off, it uses a UUID generated from the name instead. Switching modes later makes inventories, positions and operator status belong to a "different" player. Most reports of an inventory vanishing after the switch come from this.
Skins may not load
Without authentication, skins may not display correctly.
The exception: proxies
With a proxy such as Velocity or BungeeCord, the servers behind it use false and the proxy does the authentication. Two things are required:
- Configure the proxy's player information forwarding correctly.
- Block direct connections to the backend servers, for example with a firewall.
If the backend can still be reached directly, anyone can skip the proxy and join with any name.
Bedrock Dedicated Server
BDS has online-mode too. With true it checks Xbox accounts. Keep it on.
Summary
- Servers for friends and public servers: keep
true. - Servers behind a proxy:
false, with direct access blocked. - Switching later splits player data between old and new UUIDs.
To limit who can join, see the whitelist guide.
Common questions
- Can I turn it off so a friend without the game can join? Not recommended. All the risks above apply, and playing without an account is against Minecraft's terms. Have everyone join with their own account.
- Data disappeared after switching back to true. Data made while it was off is saved under other UUIDs in
world/playerdata. It can be moved across, but make a backup first. - Does this affect Open to LAN? Java's Open to LAN normally verifies accounts. The setting matters for dedicated servers.
Check your command
The Command Error Doctor checks common syntax mistakes in your browser.