LoginCustom 1.0.0

LoginCustom 1.0.0

LoginCustom 1.0.0 is the first supported stable release for Minecraft 1.21.x and 26.x. It combines secure offline-mode authentication, verified Premium accounts, two-factor authentication, proxy synchronization, Folia support, and production diagnostics in one maintained release line.

Downloads

GitHub release packages:

• LoginCustom-1.0.0-Minecraft-1.21.x.zip — Java 21
• LoginCustom-1.0.0-Minecraft-26.x.zip — Java 25
• SHA256SUMS.txt — checksums for every JAR and package

Each package contains dedicated Bukkit/Spigot, Paper/Purpur, Folia, Velocity, and BungeeCord JARs plus the compile-time public API artifact. Install only the variant matching the process. Proxy networks also require the matching plugin on every backend.

Modrinth provides the platform JARs as separate downloads.

Stable highlights

• Argon2id password hashing with random salts and a versioned external pepper keyring.
• Verified Premium linking through Minecraft's official connection handshake.
• TOTP two-factor authentication with one-use recovery codes.
• Locally generated 128x128 QR map that is locked temporarily and never replaces player items.
• Dedicated Folia builds with entity-aware scheduling.
• SQLite standalone storage and MariaDB network storage.
• HMAC-signed, expiring, replay-protected proxy sessions.
• Complete pre-authentication movement, command, chat, inventory, interaction, damage, teleport, vehicle, and server-switch restrictions.
• Configurable login location through /setlogin and spawn-login.
• Permission-aware help and tab completion for /logincustom, /lc, /2fa, and destructive confirmations.
• Encrypted login-address history and authentication-attempt inspection.
• English, Spanish, Portuguese, and French messages.
• PlaceholderAPI, public API, lifecycle events, Modrinth update checks, and optional anonymous bStats metrics.
• /logincustom doctor for storage, security, scheduler, queue, secret, and integration checks.

Security changes

• MariaDB, HikariCP, Password4j, and bStats are shaded into LoginCustom's private namespace.
• No SQLite driver classes are bundled in the modern platform JARs.
• Passwords, TOTP values, recovery codes, shared secrets, and reusable tokens are excluded from audit output.
• Paper/Spigot command logging is checked before credential commands become available. If LoginCustom disables an unsafe setting on first start, restart the server as instructed.
• TOTP QR creation is local and sends no enrollment secret to a third-party QR service.
• Full addresses are AES-256-GCM encrypted; address matching uses HMAC-derived fingerprints.
• Database or signed-channel failure keeps unauthenticated players blocked.

Upgrading from a beta or development build

1. Stop every proxy and backend process.
2. Back up the database and every LoginCustom .key file together.
3. Remove old LoginCustom JARs.
4. Install the correct 1.0.0 artifact on every process.
5. Keep the original password-peppers.key, address keys, database, and network secret.
6. Start the complete deployment.
7. Restart once if LoginCustom reports that it corrected unsafe command logging.
8. Run /logincustom doctor on each backend.
9. Test one non-Premium login, one 2FA login, and—on a mixed network—one verified Premium login.

Do not create a fresh pepper keyring for an existing database. LoginCustom intentionally rejects a database claimed by a different keyring.

Compatibility notes

• Minecraft 1.21.x uses Java 21 artifacts.
• Minecraft 26.x uses Java 25 artifacts.
• Folia requires LoginCustom-Folia.jar; the Paper artifact is not a substitute.
• Velocity/BungeeCord Premium mode requires MariaDB, the proxy plugin, backend plugins, correct forwarding, matching signed-session configuration, and network-isolated backend ports.
• Legacy and Downgrade releases remain archived and are not part of stable 1.0.0 support.

Validation

• Complete Gradle test suite and both modern assemblies passed.
• Repeated builds produced identical JAR SHA-256 hashes.
• Final 1.0.0 Paper JARs started with SQLite on Minecraft 1.21.11/Java 21 and Minecraft 26.2/Java 25.
• A real MariaDB integration round trip passed for migration, account data, TOTP, recovery codes, and deletion.
• Folia startup was verified on 1.21.4, 1.21.5, 1.21.6, 1.21.8, 1.21.11, 26.1.2, and 26.2.
• Modern artifacts were checked for correct bytecode, version descriptors, relocated libraries, and absence of bundled SQLite classes.

Read Installation, Configuration, Security, and Support before production deployment.

LoginCustom Beta 5 Dev 3 - Minecraft 26.x

LoginCustom Beta 5 Dev 3 — Minecraft 26.x

Login spawn

• Added /setlogin for administrators to save the location where players appear before authentication.
• Added spawn-login: true, enabled by default. Set it to false to disable the teleport without deleting the saved location.
• Uses the primary world spawn until /setlogin creates plugins/LoginCustom/login-spawn.yml.
• Stores world UUID/name, precise coordinates, yaw and pitch using atomic file replacement when supported.
• Keeps unrelated teleports blocked until authentication completes.
• Uses the correct Folia entity scheduler and asynchronous teleport path.

Reliability and security

• Added strict validation for the new boolean setting and saved location data.
• Added automated coverage for missing, malformed and non-finite spawn values.
• Fixed Paper 26.x backend messaging to use the valid namespaced logincustom:network channel with transactional registration.
• Verified account upgrades from Beta 4, real-app TOTP login, Premium reconnection, direct-backend rejection and fail-closed MariaDB outage recovery.

Java 25 is required. Install exactly one Bukkit, Paper or Folia backend JAR. Proxy networks additionally install the matching Velocity or BungeeCord JAR and use MariaDB.

LoginCustom Beta 5 Dev 3 - Minecraft 1.21.x

LoginCustom Beta 5 Dev 3 — Minecraft 1.21.x

Login spawn

• Added /setlogin for administrators to save the location where players appear before authentication.
• Added spawn-login: true, enabled by default. Set it to false to disable the teleport without deleting the saved location.
• Uses the primary world spawn until /setlogin creates plugins/LoginCustom/login-spawn.yml.
• Stores world UUID/name, precise coordinates, yaw and pitch using atomic file replacement when supported.
• Keeps unrelated teleports blocked until authentication completes.
• Uses the correct Folia entity scheduler and asynchronous teleport path.

Reliability and security

• Added strict validation for the new boolean setting and saved location data.
• Added automated coverage for missing, malformed and non-finite spawn values.
• Includes the namespaced backend messaging fix required by current Paper/Velocity networks.
• Verified account upgrades from Beta 4, real-app TOTP login, Premium reconnection, direct-backend rejection and fail-closed MariaDB outage recovery.

Java 21 is required. Install exactly one Bukkit, Paper or Folia backend JAR. Proxy networks additionally install the matching Velocity or BungeeCord JAR and use MariaDB.

LoginCustom Beta 5 Dev 1 - Minecraft 26.x

LoginCustom Beta 5 Dev 1 - Minecraft 26.x

Requires Java 25. Choose exactly one backend JAR: Bukkit, Paper or Folia. Add
Velocity or Bungee only when running the matching proxy network setup.

New

• Read-only public authentication API through Bukkit ServicesManager.
• Safe session lifecycle events without credentials or internal account IDs.
• Optional PlaceholderAPI expansion with authentication, registration,
  Premium, 2FA and state placeholders.
• Authentication worker-pool telemetry in /logincustom doctor.
• Placeholder rendering uses only in-memory state and performs no database IO.

PlaceholderAPI is optional and is not bundled. Existing Beta 4 databases and
configuration remain compatible; this development build adds no schema change.

LoginCustom Beta 4 Dev 1 - Minecraft 26.x

LoginCustom Beta 4 Dev 1 - Minecraft 26.x

This update adds a dedicated Folia distribution compiled for the Java 25
Minecraft 26.x line while preserving the existing Bukkit, Paper, Velocity and
BungeeCord downloads.

Highlights

• Added LoginCustom-Folia.jar with Java 25 bytecode.
• Uses Folia EntityScheduler for player-owned callbacks and delayed tasks.
• Uses GlobalRegionScheduler for console and global work.
• Database, Argon2id, Premium, network and 2FA callbacks return to the owning
  player scheduler.
• /logincustom doctor now reports the active platform scheduler.
• The authentication timeout resets after a password is accepted when TOTP is
  still required.
• Removed deprecated player kick calls from modern backend flows.

Validation

• Folia 26.2 build 1 beta: startup, SQLite, diagnostics and clean shutdown.
• Paper 26.2 startup compatibility retained.
• 31 automated tests discovered: 30 passed and one optional external MariaDB
  test was skipped.
• The Folia JAR is reproducible and contains no bundled SQLite classes.

The Folia 26.2 player flow remains marked for an additional manual client test.
Install exactly one backend JAR.

LoginCustom Beta 3 Dev 2 — Minecraft 26.x

LoginCustom Beta 3 Dev 2 — Minecraft 26.x

This Java 25 beta focuses on account security for Bukkit, Spigot, Paper,
Purpur, Velocity and BungeeCord networks.

What's new

• Optional TOTP two-factor authentication with /2fa.
• AES-256-GCM encrypted authenticator secrets.
• Persistent protection against reusing an accepted TOTP interval.
• Ten high-entropy, one-use recovery codes stored only as HMAC hashes.
• External versioned password pepper keyring in password-peppers.key.
• Transparent upgrade of valid older password hashes after login.
• Database identity claim prevents starting with the wrong pepper keyring.
• Schema v4 for SQLite and MariaDB.
• Console-only, confirmed /logincustom reset2fa <player> [confirm].
• /logincustom doctor now checks the password pepper and 2FA subsystem.

Installation

Java 25 is required. Install exactly one server JAR: Paper or Bukkit. Networks
additionally install the matching Velocity or BungeeCord JAR and require shared
MariaDB storage. Every backend connected to the same database must receive an
identical copy of password-peppers.key and the network secret.

The complete automated suite, real MariaDB integration, Paper 26.2 and
BungeeCord Java 25 smoke tests passed before publication.

LoginCustom Beta 5 Dev 1 - Minecraft 1.21.x

LoginCustom Beta 5 Dev 1 - Minecraft 1.21.x

Requires Java 21. Choose exactly one backend JAR: Bukkit, Paper or Folia. Add
Velocity or Bungee only when running the matching proxy network setup.

New

• Read-only public authentication API through Bukkit ServicesManager.
• Safe session lifecycle events without credentials or internal account IDs.
• Optional PlaceholderAPI expansion with authentication, registration,
  Premium, 2FA and state placeholders.
• Authentication worker-pool telemetry in /logincustom doctor.
• Placeholder rendering uses only in-memory state and performs no database IO.

PlaceholderAPI is optional and is not bundled. Existing Beta 4 databases and
configuration remain compatible; this development build adds no schema change.

LoginCustom Beta 4 Dev 1 - Minecraft 1.21.x

LoginCustom Beta 4 Dev 1 - Minecraft 1.21.x

This update adds a dedicated, region-aware Folia distribution while preserving
the existing Bukkit, Paper, Velocity and BungeeCord downloads.

Highlights

• Added LoginCustom-Folia.jar with Java 21 bytecode.
• Uses Folia EntityScheduler for player-owned callbacks and delayed tasks.
• Uses GlobalRegionScheduler for console and global work.
• Database, Argon2id, Premium, network and 2FA callbacks return to the owning
  player scheduler.
• /logincustom doctor now reports the active platform scheduler.
• The authentication timeout resets after a password is accepted when TOTP is
  still required.
• Removed deprecated player kick calls from modern backend flows.

Validation

• Folia 1.21.11 build 14: registration, reconnect/login, reminders and timeout.
• Paper 1.21.11 startup compatibility retained.
• 31 automated tests discovered: 30 passed and one optional external MariaDB
  test was skipped.
• The Folia JAR is reproducible and contains no bundled SQLite classes.

Install exactly one backend JAR. Do not place Bukkit, Paper and Folia downloads
on the same server.

LoginCustom Beta 3 Dev 2 — Minecraft 1.21.x

LoginCustom Beta 3 Dev 2 — Minecraft 1.21.x

This Java 21 beta focuses on account security for Bukkit, Spigot, Paper,
Purpur, Velocity and BungeeCord networks.

What's new

• Optional TOTP two-factor authentication with /2fa.
• AES-256-GCM encrypted authenticator secrets.
• Persistent protection against reusing an accepted TOTP interval.
• Ten high-entropy, one-use recovery codes stored only as HMAC hashes.
• External versioned password pepper keyring in password-peppers.key.
• Transparent upgrade of valid older password hashes after login.
• Database identity claim prevents starting with the wrong pepper keyring.
• Schema v4 for SQLite and MariaDB.
• Console-only, confirmed /logincustom reset2fa <player> [confirm].
• /logincustom doctor now checks the password pepper and 2FA subsystem.

Installation

Java 21 is required. Install exactly one server JAR: Paper or Bukkit. Networks
additionally install the matching Velocity or BungeeCord JAR and require shared
MariaDB storage. Every backend connected to the same database must receive an
identical copy of password-peppers.key and the network secret.

The complete automated suite, real MariaDB integration, Paper 1.21.11 and
Velocity Java 21 smoke tests passed before publication.

LoginCustom Beta 3 Dev 2 — Minecraft 1.16–1.20

LoginCustom Beta 3 Dev 2 — Minecraft 1.16–1.20

This beta focuses on account security for Bukkit, Spigot, Paper, Purpur,
Velocity and BungeeCord networks.

What's new

• Optional TOTP two-factor authentication with /2fa.
• AES-256-GCM encrypted authenticator secrets.
• Persistent protection against reusing an accepted TOTP interval.
• Ten high-entropy, one-use recovery codes stored only as HMAC hashes.
• External versioned password pepper keyring in password-peppers.key.
• Transparent upgrade of valid older password hashes after login.
• Database identity claim prevents starting with the wrong pepper keyring.
• Schema v4 for SQLite and MariaDB.
• Console-only, confirmed /logincustom reset2fa <player> [confirm].
• /logincustom doctor now checks the password pepper and 2FA subsystem.

Installation

Install exactly one server JAR: Paper or Bukkit. Networks additionally install
the matching Velocity or BungeeCord JAR and require shared MariaDB storage.
Every backend connected to the same database must receive an identical copy of
password-peppers.key and the network secret.

The complete automated suite, real MariaDB integration and Paper 1.16.5 smoke
test passed before publication.