Minecraft server offline mode: what it does, and the risk

By default, Minecraft checks every player who connects against Mojang’s account servers — that is what online-mode=true (the default) does, and it is what stops someone joining under a name that is not theirs. Setting it to false skips that check. This page explains what that changes, what breaks when you switch, and how it interacts with Cobbly’s sleeping servers.

What online mode actually checks

When a player joins an online-mode server, the server and the player’s game agree on an encryption key, and the server asks Mojang’s session service whether that player really logged in with that account. Only if Mojang says yes is the player let in. Their identity on the server is their account’s permanent UUID, which never changes even if they rename themselves.

What turning it off changes

• No account check. The server accepts any username offered to it, and does not check that nobody else is already using it.
• No encryption of the connection between player and server.
• Different player IDs. Without Mojang, the server cannot look up a real UUID, so it makes one up from the name. Steve and steve become two different players.
• Skins usually show as the default Steve and Alex, since the server no longer fetches them from the account.

Why people use it

The two common reasons are players on a cracked (non-premium) client, who cannot pass the Mojang check at all, and quick testing with throwaway names. The other classic reason — a server sitting behind a proxy such as Velocity or BungeeCord, where the proxy does the check — does not apply to a single Cobbly server.

The real risk

Anyone can connect as any name — including yours, or an operator’s. If someone joins as an op, they have that op’s permissions. Impersonation is not something support can act on for an offline-mode server, because there is no way to tell a real player from someone using their name. If you run a server this way, securing it is entirely on you. See the Acceptable Use Policy for the full position.

Switching modes loses player data

Because player IDs are different in each mode, switching an existing world from online to offline (or back) makes every player look new. Their inventories, ender chests, positions, advancements and statistics are stored under the old ID, so they appear to vanish — the files are still in the world folder, just not attached to anyone. Whitelist, op and ban entries made in one mode also stop matching in the other.

Decide on the mode before people start playing. If you have to switch later, download a copy of the world first from the World tab, so you have something to go back to.

How it works with a sleeping server

A sleeping Cobbly server is not running, so the server’s own online-mode setting does not come into play until it has woken up. What decides who can wake it is the whitelist:

• Whitelist off — anyone who knows the address can wake the server, premium account or not.
• Whitelist on — only names on the list can wake it, and Cobbly verifies the account with Mojang before doing so. That means a premium player has to wake the server; once it is running, offline-mode players on the list can join normally.

Turn it off

1. Open the Properties tab on the server page.
2. Set online-mode to false and save.
3. Restart the server. The setting is only read at startup.

Pair it with a whitelist

A whitelist is the practical fix for the impersonation problem: only the names on it can join or wake the server, and on Cobbly the wake step is still verified. Because Mojang verification is skipped once the server is running, the in-game whitelist matches on the exact text of the name and is case-sensitive — see Controlling who can join for the full guide.