How to allow cracked (offline) players

By default your server checks every player against Mojang's servers, which proves they own the account. Turning that check off, known as offline or cracked mode, lets anyone join with any username they type.

Read this before you turn it on

This is a genuine security trade off, not a formality. With the check off, anyone can log in as any username, including yours. Someone can join as your name and inherit your operator powers. UUID-based data such as inventories and permissions can be taken over the same way.

It also breaks things you may rely on: skins stop loading, and account-based plugin permissions become unreliable because a username is no longer proof of anything.

Public server lists generally do not allow offline-mode servers either.

How to turn it on

1. Open the Settings tab.
2. Turn on Allow cracked clients.
3. Save, then Restart the server.

If you do run offline mode, do these too

These are not optional extras, they are what replaces the check you just switched off:

• Turn on the whitelist. This is the single most effective control, because it means a guessed username still cannot get in. See Make yourself a server operator for the whitelist commands.
• Install a login plugin. On Paper, an authentication plugin makes players register a password and log in each session, so a username alone is not enough. See Install mods and plugins.
• Lower your operator level so a compromised op account cannot stop the server or ban everyone.

Turning it back off

Switch Allow cracked clients off and restart. Be aware that players who joined in offline mode were given different UUIDs, so their inventories and builds may not carry across to their real accounts.