rLogin 1.0.0

Premium players join without typing anything. Everyone else logs in with a password. On the same server, with no proxy required.

rLogin ships as a single jar that works on Paper, Folia and Velocity — it detects which one it's running on and enables only the relevant half. Drop it in plugins/, start the server once, and it works.

Premium auto-login without a proxy

Normally this combination needs a Velocity proxy in front, because online-mode is one server-wide switch. Turn on premium.standalone-hybrid-mode and rLogin performs Mojang's verification itself, so both work on a single online-mode: false server:

1. It holds the login and asks Mojang whether the name is a real premium account.
2. If it is, it runs the encryption handshake — the client shows its own "Encrypting…" screen and authenticates against Mojang on its own.
3. It confirms with Mojang's hasJoined that this client genuinely owns the account, not just that the username exists. Someone who only knows your name cannot fake this.
4. The player joins with their real Mojang UUID and skin, exactly as they would on any online-mode server — so permissions, economy and bans all see the same identity.

Requires the free PacketEvents plugin, which is not bundled. Without it rLogin says so in the console and stays off — no error, no crash.

premium.uuid-type

	Premium	Cracked
real (default)	real Mojang UUID	offline UUID
cracked	offline UUID	offline UUID
random	random, kept per name	random, kept per name

real is the only mode where "premium Steve" and "cracked Steve" are separate accounts. cracked (also accepted as offline) keeps an existing offline-mode world and database working untouched. random lets a player move between premium and cracked without losing their data.

Passwords never reach your logs

Minecraft servers write every command a player runs to the console and to logs/latest.log, verbatim — which for /login and /register means their password in plain text. The server does this before any plugin gets a say, so no plugin can stop it by cancelling the command.

rLogin filters it out at the logging layer instead. The command is still logged for your audit trail, with its arguments replaced:

Steve issued server command: /register hunter2 hunter2    ← never written
[rLogin] Steve ran /register ***                          ← written instead

This is not configurable, on purpose. Players reuse passwords across servers.

Everything else

• 2FA (TOTP) with any authenticator app, opt-in per player.
• Brute-force protection with escalating lockouts.
• Premium-name protection so a cracked player can't claim a premium name.
• "Remember me" sessions by IP, so a quick reconnect doesn't ask again.
• Bedrock players via Geyser/Floodgate are recognised automatically.
• Folia support from day one — regional schedulers, never the global one.
• 17 languages included: en, es, pt_BR, de, fr, ru, zh_CN, pl, it, nl, tr, uk, ja, ko, ar, vi, id. Drop in your own to add more.
• Velocity path with optional authentication-lobby routing.
• AuthMe import via /rlogin migrate authme.
• Passwords stored with bcrypt — irreversible, salted, cost-configurable.

Requirements

• Java 21+
• Paper or Folia 1.21+ for the backend
• Velocity 3.x only if you run a proxy
• PacketEvents only for standalone-hybrid-mode

Getting started

1. Put rLogin-1.0.0.jar in plugins/ and start the server once.
2. That's it for a normal setup. Everything else in plugins/rLogin/config.yml is documented inline and has a sensible default.
3. For premium auto-login on a single server: install PacketEvents and set premium.standalone-hybrid-mode: true.

Known limitations

• bStats reports nothing yet — the plugin has no bStats id registered, so the metrics integration stays inert until one is set.
• The nLogin and JPremium importers are not implemented. /rlogin migrate authme works; the other two tell you they aren't ready rather than pretending.
• /rlogin reload does not reach standalone hybrid-auth. Changing premium.* settings needs a full server restart to take effect.
• /rlogin changeuuid has not been exercised on a live server. It is covered by the code path but untested in practice.