Slime Login v1.0

A standalone authentication plugin for Paper, Velocity and BungeeCord. Premium players are
verified by Mojang and logged in automatically; cracked players register with a password. Bedrock
players come straight through. One jar, no dependencies — drop it in and configure.

Supported platforms

Every release in those ranges is checked before a build ships.

One jar, three roles

Drop the same file everywhere. It works out what it is on its own.

Proxy         slimelogin.jar   accounts, passwords, /login, /register
  ├─ lobby    slimelogin.jar   bridge: player frozen until authenticated
  ├─ boxpvp   slimelogin.jar   bridge
  └─ survival slimelogin.jar   bridge

A player registers once on the proxy and moves freely between every server. Backend servers hold
no passwords, no database and need no licence key.

Player commands

Admin commands

/slimeadmin (alias /sladmin)

Premium detection

Works on offline-mode servers, with no ProtocolLib and no external libraries.

• Premium accounts are detected during the login handshake and logged in automatically on their
  first join. No command, no registration, no password.

• Cracked players join instantly and register as usual — even with a name that belongs to a premium
  account, nobody is made to reconnect.

• Premium name protection — a name belonging to a real Minecraft account is reserved for its
  owner. An impostor is refused with your own message, not the client's "Invalid session" screen.

• Online-mode servers — Mojang authenticates everyone, so premium players are logged in
  automatically with no extra setup.

• A failed Mojang check is never remembered, so protection comes back the moment Mojang answers
  again instead of lingering for as long as a cached answer would.

• Prefer not to check every name automatically? Switch to opt-in, where a premium player enables it
  for themselves with /premium.

Bedrock players

Bedrock players arriving through Geyser + Floodgate join straight into the game — no
/register, no password. Xbox Live has already authenticated them, so Floodgate is trusted the same
way Mojang is. Switch it off with a single setting if you would rather they used a password.

Security

• BCrypt password hashing, cost configurable (12 by default)

• Hashing and verification always run off the server thread — no lag spike on login

• Brute-force protection with lockout, and an optional kick on lockout

• Per-player cooldown between login and register attempts

• Configurable password length limits

• Optional limit on registered accounts per IP

• Optional captcha on registration: /register <password> <confirm> <captcha>

The bypass permission is not a free pass. It only exempts an account that is genuinely verified
by Mojang (or Xbox, for Bedrock). A cracked client using a staff member's name still has to log in.

Sessions & trusted IPs

• Auto-login for returning players while their session lasts

• Sessions are bound to the IP that created them, so a username alone can never inherit one

• Trusted IP recognition, stored in the database and capped per player

• Sessions survive reconnects, not a restart. Trusted IPs survive restarts.

• An admin who is not Mojang-verified never inherits a session or a trusted IP

Protection

Everything below can be toggled individually.

On the game server — whether it runs alone or sits behind a proxy, and on any Paper fork
(Purpur, Pufferfish, Folia, Canvas …):

• Block movement — looking around still works, only walking is stopped

• Block chat, commands, inventory (click, drag, open, drop)

• Block interaction with blocks and entities, and vehicles

• Block PvP in both directions, plus mob and environmental damage

• Block breaking, placing, teleporting, item pickup

• Hide unauthenticated players from everyone else, and from each other

• Extra commands can be allowed while unauthenticated

On the proxy — chat, commands and switching to another server are blocked. Movement and blocks
belong to the game server, which is what the next part is for.

Bridge mode

Put the same jar on your backend servers and unauthenticated players are held completely still until
the proxy says otherwise. Nothing to configure — no ports, no credentials, no extra server.

A player starts locked and is only ever unlocked by the proxy, so nothing can accidentally let
someone through. A backend server that is missing the plugin is reported by name in the console, so
a forgotten server never goes unnoticed.

Auth server (optional)

Point the proxy at a small limbo server and unauthenticated players are held there, then moved to
your lobby the moment they log in.

Login spawn (Paper)

Players who still have to log in are held at a fixed location and teleported back to where they were
as soon as they authenticate.

Migrating from nLogin

One command, and passwords keep working:

/slimeadmin import nlogin

• Finds nLogin's SQLite database by itself, whatever it is called. MySQL and MariaDB work too, by
  giving the command a connection URL.

• Also reads AuthMe-shaped databases, and older nLogin versions

• Understands BCrypt, MD5, SHA-256, SHA-512 and Argon2 — every algorithm nLogin
  offers except PBKDF2, and the command tells you exactly how many accounts that affects

• Imported passwords are quietly re-hashed to your own settings as each player logs in, so the
  migration finishes itself without anybody resetting anything

• Cracked accounts are matched to the identity they actually join with, so nobody is left looking
  unregistered after the move

• A report mode summarises the database without writing anything

• Existing accounts are never overwritten unless you ask

Storage

• SQLite — local database, zero configuration, every query off the server thread

• The same database works on a single server and on a proxy, so you can move between them

• Upgrades are applied automatically

Titles & messages

• Repeating title until the player authenticates, with different text for registered and
  unregistered players

• Auto-kick after 30 seconds (configurable, or off)

• Every message editable, with colour codes and hex colours; full UTF-8, so Arabic and other scripts
  work

• Sound effects on login, register and wrong password (Paper)

• Only the options your setup actually uses are written to the config file, so it stays readable

Licence

One key runs one server — or one whole network when it sits on the proxy, since backend servers need
none. The key is bound to your server address, which you set on your purchase page.

If the licence server cannot be reached, the plugin keeps running for 72 hours on its last
successful check, so an outage on our side never takes your network down. And if a check ever does
fail, the plugin does not switch itself off — that would leave your server wide open. It simply
stops admitting new players, while everyone already online keeps playing.

Why Slime Login

• Standalone — no ProtocolLib, no external libraries, nothing else to install

• One jar for everything — Paper, Velocity, BungeeCord, Folia; standalone, proxy or bridge

• Lightweight — cached settings, async database, async password hashing

• Secure by default — sessions bound to their IP, premium names reserved, brute-force protection

• Configurable — every message and setting in plain YAML

• Modern — supports the newest Minecraft releases and regionised servers