MaxAuth ( !BETA! )

MaxAuth is a modern proxy-first authentication plugin for Minecraft networks.

It protects cracked accounts with passwords, automatically authenticates premium Java players, supports Bedrock/Floodgate players, manages UUIDs, sessions, two-factor authentication, captcha maps, backend protection, and safe migration from JPremium.

MaxAuth is based on the authentication concept and behavior of JPremium and was built as a modern successor for servers that want a cleaner, more configurable, and actively maintainable authentication system.

What is MaxAuth?
MaxAuth is not just a simple login/register plugin.

It is a complete authentication layer for Minecraft networks running behind Velocity or BungeeCord.
The proxy decides who the player is, what UUID should be used, whether the player is premium/cracked/Bedrock, whether they need to log in, and where they should be sent after authentication.

The backend plugin protects players while they are not authenticated yet.

How does it work?
When a player joins the proxy, MaxAuth checks their account type and stored profile.

• Premium players can be verified and logged in automatically.
• Cracked players are sent to a limbo/auth server and must use /register or /login.
• Session users can be logged in automatically when they reconnect from the same address.
• Backend servers receive trusted auth state from the proxy and restrict unauthenticated players.

During authorization, the backend can block movement, interactions, chat, commands, inventory usage, set player time/weather, show titles, bossbars, actionbars, and even display a captcha map.

✅ Main Features

• Proxy-first authentication system
• Velocity and BungeeCord support
• Paper/Spigot backend support
• Premium and cracked account handling
• Automatic premium player registration
• Password registration and login
• Optional password confirmation
• Modern password hashing plus legacy hash migration support
• Safe password regex and weak-password checks
• Manual and automatic sessions
• Email password recovery
• Optional TOTP two-factor authentication
• Optional captcha map for new cracked registrations
• Limbo servers for unauthenticated players
• Main-server redirects after /login and /register
• Last-server redirection
• Backend protection through access tokens and trusted proxy IPs
• SQLite, MySQL, MariaDB, and PostgreSQL support
• Configurable HikariCP connection pool
• Configurable messages with chat, title, subtitle, bossbar, actionbar, and kick screen types
• Hex colors and gradients in messages
• Admin commands under /maxauth and /mauth
• Discord audit webhooks
• Automatic config/message updates for new settings
• JPremium database migration helper

Supported Password Hashes
MaxAuth supports modern password hashing algorithms for newly created or rehashed cracked-player passwords.

Recommended for new passwords:

• ARGON2ID
• BCRYPT

Other configurable algorithms:

• PBKDF2_SHA256
• PBKDF2_SHA512
• SALTEDSHA512
• SHA256 - MaxAuth salted SHA-256
• SHA512 - MaxAuth salted SHA-512

Migration-only hashes accepted from the database:

• SALTEDSHA256
• DOUBLE_SHA512
• AUTHME_SHA256
• AUTHME_SHA
• PBKDF2
• CSHA256 - classic unsalted SHA-256
• CSHA512 - classic unsalted SHA-512
• MD5VB
• IPB3
• IPB4
• JOOMLA
• MYBB
• PHPBB
• PHPFUSION
• SMF
• WBB3
• WBB4
• XFBCRYPT
• ROYALAUTH
• MD5
• SHA1
• DOUBLE_MD5
• DOUBLE_SHA1
• BCRYPT2Y

When rehashPasswordWhenUsingDifferentAlgorithm is enabled, legacy passwords are automatically upgraded to the configured hashing algorithm after a successful login.

Note: SHA256 and SHA512 in MaxAuth are salted hashes. Classic unsalted SHA-256 and SHA-512 are supported for migration as CSHA256 and CSHA512.

⭐ Based on JPremium
MaxAuth is heavily inspired by the original JPremium authentication flow.

It keeps many familiar ideas:

• Premium automatic authentication
• Cracked /register and /login flow
• Limbo authorization servers
• Premium username protection
• Sessions
• Two-factor authentication
• Email recovery
• Captcha during registration
• UUID mode handling

But MaxAuth adds a cleaner configuration structure, modern message system, backend protections, diagnostics, Discord audit logging, automatic config/message updates, and a safe migration tool.

Migration from JPremium
MaxAuth includes a migration helper for servers moving from outdated JPremium.

If MaxAuth detects the old JPremium SQL table user_profiles, it creates a migration report file:

plugins/maxauth/migrate_DB.yml

The file shows:

• How many old JPremium accounts were found
• How many accounts can be migrated
• How many accounts would be skipped because of collisions
• Whether required columns are present

Migration is manual and safe.
You review the report, enable migration, restart the proxy, and MaxAuth transfers the old accounts into the new MaxAuth table.

Existing MaxAuth accounts are preferred if a collision exists.

Plugin Structure
MaxAuth has two parts in one plugin jar:

• Proxy plugin - installed on Velocity or BungeeCord
• Backend plugin - installed on Paper/Spigot servers behind the proxy

The proxy is the main authority.
The backend protects players during authorization and verifies that auth state updates really came from the trusted proxy.

⚙️ Supported Platforms
Proxy:

• Velocity
• BungeeCord

Backend:

• Paper
• Spigot

Java:

• Java 17 or newer

Databases:

• SQLite
• MySQL
• MariaDB
• PostgreSQL

Authentication Flow

• Player connects to the proxy
• MaxAuth checks account type and stored profile
• Premium users may be authenticated automatically
• Cracked users are sent to limbo/auth server
• Backend restrictions are applied while unauthenticated
• Player uses /register or /login
• MaxAuth updates the auth state
• Player is redirected to the configured main server

Messages and Styling
MaxAuth has a highly configurable message system.

You can configure:

• Chat messages
• Titles
• Subtitles
• Bossbars
• Actionbars
• Kick screens
• Admin command messages
• Login/register instructions

Messages support classic Minecraft color codes and hex colors.

Example:

{prefix} &8» &aSuccessfully logged in!

Gradient format is supported too:

{#55ff55>}MaxAuth{<#55ffff}

Admin Tools
MaxAuth includes useful admin and development commands.

• /maxauth - Shows plugin info
• /maxauth help - Shows command help
• /maxauth reload - Reloads configuration and messages
• /maxauth configcheck - Checks current configuration
• /maxauth checkflow - Shows current authentication flow
• /maxauth testmail <email> - Sends a diagnostic recovery email test
• /maxauth spawnset - Sets backend auth spawn location
• /maxauth viewuserprofile - Shows user profile information
• /maxauth unregister - Admin unregister command
• /maxauth login - Admin login command

/maxauth testmail <email> uses the executor nickname and recovery code 123456, then reports SMTP host, port, encryption mode, send time, and success or failure status in chat.

Player Commands

• /register <password> - Register cracked account
• /login <password> - Log into cracked account
• /changepassword - Change password
• /unregister - Remove own registration
• /premium - Switch account to premium mode
• /cracked - Switch account to cracked mode
• /startsession - Start manual session
• /destroysession - Destroy session
• /requestsecondfactor - Start 2FA setup
• /activatesecondfactor - Activate 2FA
• /deactivatesecondfactor - Disable 2FA
• /requestpasswordrecovery - Request password recovery email
• /confirmpasswordrecovery - Confirm password recovery

Password recovery player commands are available only during the login phase, before the player logs in. If confirmPassword is enabled, /confirmpasswordrecovery requires the repeated password:

/confirmpasswordrecovery <recovery-code> <password> <password>

️ Backend Protection
The backend plugin can protect unauthenticated players by blocking:

• Movement
• Chat
• Commands
• Interactions
• Inventory usage
• Damage-related actions

It can also:

• Teleport players to auth spawn
• Lock player time during authorization
• Lock player weather during authorization
• Apply blindness effect
• Show captcha map
• Verify trusted proxy state updates

Discord Audit Webhooks
MaxAuth can send audit logs to Discord webhooks.

You can configure multiple webhook targets and decide what each webhook should receive.

Useful for:

• Admin commands
• Login/register events
• Failed login attempts
• Kicks
• Password recovery events
• 2FA events
• Profile changes
• Security-related actions

Proxy Configuration Example