rlg

rLogin

Premium players join without typing anything. Everyone else logs in with a password.

What is rLogin?

Most authentication plugins make you choose: run online-mode: true and lose every player without an account, or run offline and ask everybody for a password — the owners of real accounts included.

rLogin does neither. It verifies premium accounts against Mojang itself, so they are let straight in with their genuine UUID and skin, while everyone else registers with a password as usual. It works the same on a single server as it does behind a proxy, and 17 languages ship with it.

Why the UUID matters

Plenty of plugins can wave a premium player through. Far fewer give them the UUID Mojang actually issued them.

On an offline server the UUID is derived from the name, so "Notch" is whoever types Notch — and if you later switch to online mode, every permission, balance and ban is attached to the wrong identity. rLogin hands the connection the genuine profile it got back from Mojang, exactly as a proxy would, so your other plugins see the same UUID they would on any online-mode server.

Where can I use rLogin?

Folia too — it has no badge in this set, but rLogin has supported it from day one. One download, rLogin-<version>.jar, runs on all of them: the same file goes into a Paper/Folia server's plugins/ and into a Velocity proxy's. Velocity 3.x and 4.x both work.

Features

• Real Mojang UUIDs and skins on a standalone online-mode: false server
• Password login for everyone else — frozen in place until they register
• Two-factor authentication (TOTP) through any authenticator app
• "Remember me" sessions, so a quick reconnect doesn't ask again
• Brute-force protection with escalating lockouts by address, never by account
• Premium name protection — cracked players can't claim a real account's name
• Passwords never reach your logs, and that is not a setting anyone can turn off
• 17 languages, every message editable
• Spawn points for joining, first join, logging in and registering
• Account recovery — one-time codes, so a forgotten password or a lost phone doesn't need an admin
• Bedrock support through Geyser/Floodgate
• Import from AuthMe, nLogin, JPremium and LoginSecurity, hashes included
• LuckPerms integration — scope permissions to players who actually logged in, and carry ranks across a UUID change
• Developer API with events, published through JitPack
• MySQL or SQLite

Requirements

Installation

1. Drop rLogin-<version>.jar into plugins/ on every server, proxy included.
2. Set online-mode=false in server.properties, and online-mode = false in velocity.toml if you run a proxy.
3. On a standalone server, install PacketEvents next to it.
4. Start. There is nothing else to configure.

What online-mode has to be

This is the one setting people get wrong, so rLogin refuses to start when it is wrong rather than look healthy while serving nobody.

With online-mode on, the server or proxy turns away every player without a Minecraft account before rLogin is consulted at all. On a server built for those players that is the whole audience gone, so auto and offline require it off. auth-mode: online is the one case where turning them away is the point.

Velocity is the only proxy with an rLogin plugin. A backend behind BungeeCord will detect the forwarding and not verify twice, but nothing routes the login, so players are asked again on every server switch.

Documentation

Every setting, all commands and permissions, and troubleshooting: https://pyrelight.mintlify.app/rlogin/introduction

What if I need support?

Join our Discord server and we will help you out, or open an issue on GitHub.

Want to support us and the plugin?

rLogin is free, and stays free, so that any server can use it. If it saved you some trouble and you would like to say thanks, a donation helps keep the work going.

Sponsors

Thanks to the following sponsor for supporting this project:

Statistics

MIT licensed. PacketEvents is a separate GPL-3.0 plugin that rLogin talks to at runtime; it is never bundled.