Premium auto-login now turns itself on wherever it is needed. There is no setting to find, and no setting to forget.

rLogin reads how your server is set up and verifies exactly when nothing else does. On a standalone online-mode: false server that means PacketEvents is required — without it rLogin refuses every connection, with a banner in the console and an explanation on the player's screen. Switching the plugin off instead would leave an offline-mode server with no authentication at all.

Your config survives upgrades. New settings are merged into your existing file, in the right section, with their comments, and every value you had set is left alone.

Security

• Brute-force lockout moved from the account to the address. Locking the account let anyone who knew a name keep its owner out by failing logins on purpose.
• "Remember me" is never applied to an account with 2FA, and changing a password cancels it.

Also

• premium.uuid-type: real / cracked / random.
• Every message is a config key now, in all 17 languages.
• /rlogin spawn is one layer instead of two, plus teleport to check a spawn.
• The proxy config is two sections; the database belongs to the backends only.
• /rlogin reload no longer leaks a connection pool per call.

Fixes

• A cracked player carried by "remember me" was bounced once per session, forever.
• /2fa enable on an account that already had it silently broke the player's authenticator.

Requires Java 21+ and Paper/Folia 1.21+. Velocity 3.x only if you run a proxy.