Secura2FA is a security-focused Spigot/Paper plugin that adds mandatory two-factor authentication (2FA) for Minecraft servers.

Players cannot move or use commands until authentication is completed.

Features

• Google Authenticator — TOTP authentication with QR code
• Telegram — login confirmation via Telegram bot
• AES-256-GCM — encrypted 2FA secret storage
• SQLite / MySQL — flexible database support
• Redis — optional caching
• 3 Languages — English, Ukrainian, German
• Customizable messages — Minecraft & color codes supported

Requirements

Commands

Alias: /twofa

Permissions

Configuration

Main options:

Prefix: '&5&l2FA &8≫ '
Language: 'en'
Metrics: 'true'
Servername: 'MinecraftServer'
RegisterPerm: 'system.2fa.register'
Autologin: 'true'
Range: '900'
Type: 'choice'
TypePerm: 'system.2fa.needed'
ReloadKick: 'true'
Updates: 'true'
UpdatePerms: 'system.ads.notify'

Use: 'false'
Host: '127.0.0.1'
Port: '3306'
Database: '2fadb'
Username: 'User'
Password: '123456789'

TelegramBotToken: ''
TelegramBotUsername: ''

RedisUse: 'false'
RedisHost: '127.0.0.1'
RedisPort: '6379'
RedisPassword: ''
RedisDatabase: '0'

Important: Change the default database password before using the plugin in production.

Languages

Language files are located in:

plugins/2FA/lang/

Supported languages:

en · uk · de

All messages can be customized.

Telegram Setup

1. Create a Telegram bot using @BotFather.
2. Add the bot token and username to config.yml.
3. Restart the server.
4. Run /2fa te.
5. Send /start <code> to the bot.
6. Confirm future login attempts through Telegram.

If the login was already verified using Google Authenticator, Telegram will automatically recognize it as verified.

License

MIT License — License.
GitHub — REPOSITORIES.