PAL⚡Player Advanced Login「1.8 - 26.3」

PAL — Player Advanced Login
A free, open-source authentication plugin for Bukkit-compatible Minecraft servers.

PAL protects Minecraft servers with offline account registration, password login, premium identity handling, Bedrock identity support, sessions, pre-auth restrictions, migrations, placeholders, LuckPerms contexts and optional proxy session bridging.

Beta notice: PAL 0.1.0 is intended for staging and controlled beta networks. Test it with your exact server stack and keep database/config backups before using it on a public production network.

What PAL does

PAL protects your server before authentication is complete. Offline players can register and log in with passwords, premium players can be trusted only when ownership is actually verified, and Bedrock players can be detected through Floodgate/Geyser.

PAL works for both small single-server setups and larger proxy networks. On a single server, PAL can run with SQLite. On a network, PAL can sync signed sessions through Redis or a shared SQL database with the optional PAL Proxy addon.

Main features

• Offline/cracked account registration and login.
• Premium auto-login through verified sources only: Bukkit online-mode, FastLogin, or PAL Proxy login-phase verification.
• Bedrock identity handling through Floodgate/Geyser.
• Hybrid premium/cracked behavior for offline-mode networks.
• PBKDF2-SHA256 password hashing with automatic rehash on login.
• Configurable password policy: length limits, username blocking, common-password blocking and repeated registration confirmation.
• Persistent auth sessions with optional IP and username binding.
• TOTP two-factor authentication with backup recovery codes.
• Pre-auth restrictions for movement, chat, commands, inventory, drops, pickups, damage, block actions and teleports.
• Logical AUTH, LOBBY and LIMBO realms with separate restrictions, spawn points and effects.
• SQLite, MySQL, MariaDB and PostgreSQL storage.
• Redis or shared SQL bridge for network sessions.
• Importers for AuthMe, nLogin, OpeNLogin, LibreLogin, LoginSecurity and FastLogin.
• PlaceholderAPI expansion.
• LuckPerms runtime contexts.
• Bukkit API events for account and session lifecycle changes.
• Fully configurable commands, aliases, permissions and messages.

Supported integrations

• FastLogin — verified premium login decisions.
• Floodgate/Geyser — Bedrock identity detection.
• PlaceholderAPI — %pal_*% placeholders.
• LuckPerms — auth/session/storage runtime contexts.
• PAL Proxy — Velocity/BungeeCord network guarding and session handoff.

Player commands

• /login <password> — alias: /l — permission: pal.command.login
• /register <password> <password> — alias: /reg — permission: pal.command.register
• /changepassword <old-password> <new-password> — aliases: /changepw, /cpw — permission: pal.command.changepassword
• /logout — permission: pal.command.logout
• /unregister confirm — permission: pal.command.unregister
• /premium confirm — permission: pal.command.premium
• /cracked confirm — alias: /offline — permission: pal.command.cracked
• /pal2fa <code/setup/confirm/disable/recover> — alias: /2fa — permission: pal.command.2fa

Admin commands

The admin root command is /pal, with /palauth as an alias.

• /pal info
• /pal reload
• /pal help
• /pal account <player>
• /pal session <player>
• /pal session clear <player>
• /pal force-login <player>
• /pal force-logout <player>
• /pal reset-password <player> <password>
• /pal unregister <player>
• /pal migrate <provider>
• /pal migrate all

Admin permissions are split by action, including pal.admin, pal.admin.reload, pal.admin.session, pal.admin.force-login, pal.admin.force-logout, pal.admin.reset-password, pal.admin.unregister and pal.admin.migrate.

Placeholders and contexts

PAL includes PlaceholderAPI values for authentication state, session source, session expiry, 2FA state, bridge mode, storage type, FastLogin availability and Floodgate availability.

When LuckPerms is installed, PAL can expose:

• pal:authenticated
• pal:session_source
• pal:2fa_pending
• pal:bridge_mode
• pal:storage_type

Installation

Single server

1. Put PAL-<version>.jar in your Bukkit/Paper/Folia plugins folder.
2. Start the server once.
3. Review security.yml, storage.yml, premium.yml, commands.yml and messages.yml.
4. Keep storage.type set to SQLITE for small single-server installs.
5. Test /register <password> <password> and /login <password>.

Network setup

1. Install PAL on the Bukkit auth/lobby server.
2. Install PAL Proxy on Velocity or BungeeCord.
3. Use remote SQL for accounts and sessions.
4. Use Redis for the recommended signed session bridge, or DATABASE mode when Redis is not available.
5. Set the same bridge.sec.secret on Bukkit and proxy.
6. Firewall backend servers and use proxy forwarding secrets.

Important security notes

PAL does not treat a Mojang name lookup as proof of premium ownership. Premium auto-login is trusted only when the connection is verified by Bukkit online-mode, FastLogin, or PAL Proxy.

For production networks, use MySQL/MariaDB/PostgreSQL and Redis where possible. SQLite is intended for single-server setups or controlled tests, not multi-backend production networks.

PAL’s backend guard is not a firewall replacement. Always protect backend servers with proper network rules and proxy forwarding configuration.

Support

If you need help, include your server software/version, PAL version, storage type, bridge mode, proxy software, installed integrations and relevant logs. Do not use review sections for support; use the configured support channel first.