> For the complete documentation index, see [llms.txt](https://impoo.gitbook.io/authenticationsystem/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://impoo.gitbook.io/authenticationsystem/introduction.md).

# Introduction

## What is AuthSystem?

AuthSystem is a Minecraft Paper authentication plugin that protects your server by requiring players to register and log in before they can play. It is designed for **cracked servers** (servers running in online-mode=false) where Mojang account verification is disabled, but it also works alongside premium accounts.

With AuthSystem, players must create an account with a password on their first join. On subsequent joins, they must log in before they can send commands or chat. Unauthenticated players are restricted to authentication commands only.

## Features

### Player Authentication

* **Registration** — new players create an account with `/register <password> <confirmPassword>`
* **Login** — returning players log in with `/login <password>`
* **Password change** — players can change their own password with `/changepassword <oldPassword> <newPassword>`

### Premium Support

* **Premium detection** — players with valid Mojang accounts are automatically recognized
* **Double-click confirmation** — premium players confirm their identity within 10 seconds

### Security

* **Brute-force protection** — 5 failed attempts per player, 10 per IP, then kick or ban
* **Authentication timeout** — players have 60 seconds (by default) to log in before being kicked
* **IP tracking** — each player's last IP is recorded and can be checked by staff
* **Chat and command restrictions** — unauthenticated players cannot chat or run most commands

### Database

* **MySQL / MariaDB** storage via HikariCP connection pool
* **BCrypt password hashing** (cost 12) for secure password storage
* **Automatic table creation** — the `auth_players` table is created on startup

### Administration

* **Admin commands** — change passwords, unregister players, check IPs, reload config
* **Granular permissions** — control who can use each admin command
* **Multilingual messages** — English and Italian with MiniMessage formatting
* **Update checker** — checks for new versions via the Modrinth API

***

> :bulb: **Tip**: AuthSystem is designed to be secure by default. Passwords are never stored in plain text — they are hashed with BCrypt before being saved to the database.