🛡️ xLogin – Simple, Lightweight & Powerful Authentication

banner-es

xLogin is an all-in-one authentication system designed for servers that want maximum security without the bloat. Forget about complex external database setups; xLogin is optimized to work locally, fast, and secure out of the box, whether you run a standalone server or a massive Proxy network.

Note: /premium is only available for networks and proxies. Compatible with Bungeecord, Velocity, Waterfall, and others.
How do I activate proxy mode?
Go to config.yml and enable proxy mode, then download and install the add-on for your proxy, and you're all set!

🚀 Key Features

🌐 Smart Network & Proxy Ready: Fully compatible with BungeeCord and Velocity. Features auto-detection to enable secure UUID verification and includes an automatic Auth-Lobby redirect system to send players to a specific server upon successful login.
📦 Local-First Storage & Backups: High-performance, thread-safe H2 database system (data.mv.db). No need for MySQL to get professional network-level performance. Easily create instant database backups via in-game commands!
💎 Smart Premium System: Using an official Minecraft account? Players can use /premium to enable auto-login. The plugin uses real Mojang validation (via your Proxy) to ensure nobody can steal a premium identity.
🧠 Industrial-Grade Security:
- BCrypt Hashing: Passwords are encrypted with the industry standard, making them virtually impossible to crack.
- Premium Name Impersonation Protection: Automatically kicks non-premium players trying to join with the username of an official purchased account.
- Anti-Bot Captcha: A visual verification system during registration to stop bot attacks in their tracks.
- Total Protection: Blindness, immobilization, and block/damage protection until the user is authenticated.
- Asynchronous Logging: Keeps a silent, detailed history of logins, registrations, and admin actions.
🖼️ Ultimate Admin Control: Manage everything from the console or in-game. Features an intuitive visual GUI menu with player heads, plus a massive arsenal of commands to purge inactive users, force logins, change UUIDs, and more.
📱 Bedrock Support (Geyser): Fully compatible with console and mobile players via Floodgate integration. Bedrock players authenticated via Xbox Live can automatically bypass the login screen (100% configurable).
⚡ Performance Optimized: Fully asynchronous database operations ensure your TPS stays at 20.0, no matter how many players are joining.

🛠️ Commands & Permissions

Player Commands

Command	Description	Permission
`/login <pass>`	Log in to your account.	None
`/register <pass> <pass>`	Create a new account with captcha.	None
`/premium [confirm]`	Toggle Auto-login (Premium Mode).	None
`/changepassword <old> <new>`	Securely change your current password.	None
`/captcha <code>`	Solve the registration captcha.	None

Admin Commands (`xlogin.admin`)

Command	Description
`/xlogin gui`	Open the visual administration menu.
`/xlogin backup`	Create an instant backup of the database.
`/xlogin purge <days>`	Delete all accounts inactive for `<days>`.
`/xlogin verify <user>`	View a player's UUID, IP, Premium status, & last login.
`/xlogin forcelogin <user>`	Forcefully log a player into the server.
`/xlogin setspawn` / `spawn`	Set or teleport to the login spawn location.
`/xlogin changepass <user> <pass>`	Forcefully change a player's password.
`/xlogin changeuuid <user> <uuid>`	Manually update a player's registered UUID.
`/xlogin unpremium <user>`	Remove the premium auto-login status from an account.
`/xlogin unban <ip>`	Remove an IP from the registration blacklist.
`/xlogin unregister <user>`	Completely delete a player's account.
`/xlogin reload`	Reload the plugin configuration and messages.

⚙️ Simplified Configuration

We've stripped the config down to the essentials so you don't waste time, while giving you absolute control over your network.

`config.yml`

# -------------------------------------------------------
#           __             _
#   __  __ / /  ___   __ _(_)_ __
#   \ \/ // /  / _ \ / _` | | '_ \   Made by xPlugins
#    >  </ /__| (_) | (_| | | | | |     Fork: Paper
#   /_/\_\____/\___/ \__, |_|_| |_|
#                  |___/ Release v1.0.6
#
#        Wiki: [https://xplugins.es/xlogin](https://xplugins.es/xlogin)
#    24/7 Support: [https://discord.gg/AH5k9YE78b](https://discord.gg/AH5k9YE78b)
# -------------------------------------------------------

settings:
  # The default language (es, en). It will load messages_es.yml or messages_en.yml
  language: "en"

protection:
  # Block everything before logging in (movement, chat, etc.)
  general-protection: true

  # Visual effects upon joining the server
  effects:
    blindness: true

security:
  # Auto-register premium users detected by the proxy (Requires BungeeCord/Velocity)
  auto-premium-registration: false
  # Prevents Non-Premium players from using premium account names (Requires BungeeCord/Velocity)
  prevent-premium-name-impersonation: false

  # Allowed commands BEFORE logging in
  allowed-commands-before-login:
    - "/help"
    - "/rules"
    - "/discord"

passwords:
  size:
    min: 6
    max: 20

#      ___          _                _
#   / __\ ___  __| |_ __ ___   ___| | __
#  /__\/// _ \/ _` | '__/ _ \ / __| |/ /
# / \/  \  __/ (_| | | | (_) | (__|   <
# \_____/\___|\__,_|_|  \___/ \___|_|\_\
geyser-support:
  # If true, Bedrock players (Floodgate) join without needing to login.
  auto-login-bedrock: true

#      __     _                      _
#   /\ \ \___| |___      _____  _ __| | __
#  /  \/ / _ \ __\ \ /\ / / _ \| '__| |/ /
# / /\  /  __/ |_ \ V  V / (_) | |  |   < 
# \_\ \/ \___|\__| \_/\_/ \___/|_|  |_|\_\
proxy-redirect:
  # Send the player to the target server after a successful login (ideal for Auth&Lobby)
  enabled: false
  target-server: "Lobby"

captcha:
  enabled: true
  timeout-seconds: 120

ui:
  titles:
    before-login:
      title: '&#A9DFBFWelcome!'
      subtitle: '&fUse /login <password>'
    before-register:
      title: '&#FAD7A0Register!'
      subtitle: '&fUse /register <password> <password>'
    after-login:
      title: '&#A9DFBFSuccess!'
      subtitle: '&fEnjoy your stay'
    incorrect-password:
      title: '&#F1948AIncorrect Password!'
      subtitle: '&7Please try again'

logging:
  enabled: true
  log-successful-logins: true
  log-registrations: true
  log-failed-attempts: true
  log-admin-actions: true

xLogin

📖About xLogin