🌙 SleepyAuth
Sleep peacefully. Your server is protected.
Advanced authentication & account protection for Paper servers
📖 About
SleepyAuth is an authentication and account-protection plugin for Paper servers. It asks players to register or log in, restricts unauthenticated players, and provides account security, session management, moderation tools, maintenance mode, logging, and optional Discord/Floodgate features.
Offline-mode (cracked) servers have no Mojang authentication — anyone can join as any username. SleepyAuth fixes this by locking usernames to real owners, protecting player progress, and adding layered security.
Compatibility: Paper 1.20.x and newer (Java 17 bytecode; Paper 1.21+ needs Java 21)
Optional Integrations: Floodgate for Bedrock detection • Discord webhooks for event notifications
✨ Features
🔐 Registration & Login
Players register with /register <password> <password> [true|false] and log in with /login <password>. Passwords are hashed — PBKDF2 by default, with salted SHA256 support. Plaintext passwords are never stored or logged.
🛡️ Login Protection
Unauthenticated players receive prompts and action-bar reminders. Join/quit announcements are suppressed until authentication. Configurable restrictions block movement, chat, commands, interactions, damage, hunger, item pickup/drop, and inventory access.
🌌 Void World Protection
An optional generated void world isolates unauthenticated players on a small protected platform. Prevents base stealing, coordinate leaking, griefing, and player tracking.
⏱️ Protection Countdown
After login, a configurable countdown shows a TextDisplay above the player and blocks damage until it expires. Can apply only to first-time registrations.
🔑 Remember Me & Sessions
Optional Remember Me tokens provide longer auto-login (configurable lifetime, optional same-IP enforcement). Short-lived sessions restore login after disconnects. Cleared on logout or password change.
🎮 Bedrock / Floodgate Support
Optional Floodgate detection recognizes Bedrock players. By default, verified Bedrock players skip authentication; force-auth can require them to register or log in instead.
👥 Alt Detection
Tracks registered accounts that share the same IP. Auto-creates alternate-account records (without password hashes) and can alert admins in-game or via Discord.
🔒 Account Security
Per-account brute-force lockouts, per-IP failed-login rate limiting, account-per-IP limits (with bypass permission), and same-name/different-IP connection checks. Lockouts persist in bans.yml across restarts.
🛠️ Admin Tools
Full admin command suite: /sa reload, /forcelogin, /forcelogout, /resetpassword, /unban, /sessions, /info, /stats, /void, and more. Java admins must authenticate by default.
🚧 Maintenance Mode
/maintenance on [reason] [| estimated time] announces a kick countdown, rejects new non-staff connections, and kicks current non-staff players. Operators are exempt unless configured otherwise.
🔗 Discord Webhook Logging
Colored embeds for first-time registrations, alt detections, admin force-logins, private messages (/msg, /tell, /whisper), sign placement/edits, and maintenance start/end.
📍 Spawn System
Teleport players to spawn before login, then return them to their last saved or configured location after authentication.
📜 Commands
👤 Player Commands
| Command | Description |
|---|---|
/register <password> <password> [true|false] |
Create an account (optional Remember Me toggle) |
/login <password> |
Log into your account |
/logout |
Log out and clear Remember Me token |
/changepassword <old> <new> |
Change your password |
/unregister <password> |
Delete your account |
/rememberme <true|false> |
Toggle Remember Me |
🛠️ Admin Commands
| Command | Description |
|---|---|
/sa help |
Show admin command list |
/sa reload |
Reload config & messages |
/sa forcelogin <player> |
Authenticate an online player |
/sa forcelogout <player> |
Return player to unauthenticated state |
/sa resetpassword <player> <new> |
Reset a player's password |
/sa unban <player|ip> |
Remove lockout or rate-limit state |
/sa sessions |
List active remembered sessions |
/sa info <player> |
Show player account details |
/sa stats |
Show plugin statistics |
/sa void |
Toggle between void world and spawn |
/maintenance on/off [reason] [| time] |
Toggle maintenance mode |
🔑 Permissions
| Permission | Description | Default |
|---|---|---|
sleepyauth.admin |
All admin permissions | OP |
sleepyauth.reload |
/sa reload |
OP |
sleepyauth.forcelogin |
/sa forcelogin |
OP |
sleepyauth.forcelogout |
/sa forcelogout |
OP |
sleepyauth.resetpassword |
/sa resetpassword |
OP |
sleepyauth.unban |
/sa unban |
OP |
sleepyauth.sessions |
/sa sessions |
OP |
sleepyauth.info |
/sa info |
OP |
sleepyauth.stats |
/sa stats |
OP |
sleepyauth.void |
/sa void |
OP |
sleepyauth.maintenance |
/maintenance |
OP |
sleepyauth.bypass |
Java admin login bypass | — |
sleepyauth.bypass.iplimit |
Bypass IP account limit | OP |
📝 Changelog
V4.0.0 — Stable Authentication & Security Update
✨ New
- Void World Protection for unauthenticated players
- Protection Countdown with TextDisplay & damage blocking
- Account-per-IP limit with bypass permission
- Alternate-account tracking (no password hashes copied)
- Remember Me toggle (
/register ... [true|false],/rememberme) - Floodgate/Bedrock auto-login support
- Maintenance Mode with reason & estimated time
- Discord webhooks: registrations, alts, force-logins, PMs, signs, maintenance
- Spawn system — return to last saved or configured location after login
- Admin tools:
/sa forcelogin,/sa forcelogout,/sa resetpassword,/sa unban,/sa sessions,/sa info,/sa stats,/sa void
🔧 Changed
- Paper 1.20.x+ support (Java 17 bytecode)
- PBKDF2 default hashing (SHA256 fallback); BCrypt/Argon2 fall back to PBKDF2
- Async password hashing & verification
- Brute-force lockouts + IP rate limiting with persistence in
bans.yml - Configurable restrictions: movement, chat, commands, interaction, damage, hunger, items, inventory
- Java admins must authenticate by default
⚠️ Notes
- No tags or rank system
- Passwords never logged in plaintext
- Requires Java 21+ on Paper 1.21 servers
🚀 Why SleepyAuth?
SleepyAuth is designed to provide more than just a basic /login command.
It combines authentication, security, session management, moderation tools, and server utilities into one organized plugin.
The goal is simple:
«Keep players protected while making server management easier.»
Install SleepyAuth, configure it for your server, and let your players enjoy a safer Minecraft experience.
📥 Installation
- Use a Paper server (install Floodgate separately if Bedrock detection is needed)
- Place
SleepyAuth-4.0.0.jarin your server'spluginsfolder - Start the server once to create config and data folders
- Review
config.yml— especially authentication, account limits, void-world, maintenance, and Discord settings - You're done! 🎉
Building from source:
mvn clean package
# Output: target/SleepyAuth-4.0.0.jar
💬 Etherno Project — Community & Support
SleepyAuth is developed for the Etherno Project Minecraft server.
Join our Discord to:
- 🎮 Join the Etherno Project Minecraft server
- 💬 Get help & support with SleepyAuth
- 🐛 Report bugs
- 💡 Suggest features
- 📢 See the latest updates & announcements
- 🤝 Hang out with our community
🌙 SleepyAuth
Simple. Secure. Reliable.
«Sleep peacefully. Your server is protected.»
Made with ❤️ by the Etherno Project team
Access detailed player authentication records through this user-friendly interface. View when players registered, track their login history, monitor active sessions, and check account status without running complex commands.
Access the full SleepyAuth administration panel with the /sauth admin command. This GUI provides staff with tools to manage player accounts, view authentication records, reset passwords, and control plugin settings without typing complex commands.
| Version | Minecraft | Loader | Download |
|---|---|---|---|
|
SleepyAuth 4.0.0 4.0.0 |
1.20, 1.20.1, 1.20.2, 1.20.3, 1.20.4, 1.20.5, 1.20.6, 1.21, 1.21.1, 1.21.2, 1.21.3, 1.21.4, 1.21.5, 1.21.6, 1.21.7, 1.21.8, 1.21.9, 1.21.10, 1.21.11
|
bukkit, paper, purpur, spigot
|
Download |
|
SleepyAuth 3.0.0 3.0.0 |
1.20, 1.20.1, 1.20.2, 1.20.3, 1.20.4, 1.20.5, 1.20.6, 1.21
|
bukkit, paper, purpur, spigot
|
Download |
|
SleepyAuth 2.0.2 2.0.2 |
1.20, 1.20.1, 1.20.2, 1.20.3, 1.20.4, 1.20.5, 1.20.6
|
bukkit, paper, purpur, spigot
|
Download |