What is a cracked Minecraft server, and is it safe?

A cracked Minecraft server is a Java server that runs in offline mode, which means it lets players join without checking that they own a paid Minecraft account. It can be safe to play on, but only if the server uses a login plugin and you never reuse an important password there, because on an offline-mode server the server, not Mojang, has to stop people from logging in with your name.

Looking for one? The cracked server list shows 19 cracked servers playable right now, with 925 players.

What cracked means

"Cracked" comes from piracy slang, where a cracked copy of a game has its license check removed. For servers, the word describes one setting. You will also see non-premium (premium means a bought account) and offline-mode, which is the technical name. The word is about the server, not the players on it: players with a paid account can join cracked servers too. On serverlist.net the tag is called cracked, and the old offline tag points to it. Other words you meet on listings are explained in Minecraft server types A to Z.

Online mode and offline mode

Here is what normally happens when you join a Java server:

1. Your launcher signs in to your Microsoft account and receives a session token.
2. When you connect to a server in online mode, your game tells Mojang's session service which server you are joining, and the server asks Mojang to confirm it. If Mojang confirms, the server learns your real name and your account's unique ID, and the connection is encrypted.
3. In offline mode (online-mode=false in the server's server.properties), step 2 is skipped. The server accepts whatever name your game sends, calculates an ID from that name, and the vanilla server does not encrypt the connection.

Two side effects follow. Because the ID is built from the name alone (from the text "OfflinePlayer:" plus your name), the same name gets the same ID on every offline server, and changing your name makes you a different player as far as the server is concerned. And because the server never talks to Mojang about you, it cannot load your skin from your account, which is why cracked servers run skin plugins.

Offline mode on its own is not the same as cracked. Large networks run their game servers in offline mode behind a proxy such as Velocity or BungeeCord, and the proxy does the online check and passes the verified identity on. A network is cracked only when the proxy itself lets unverified players in.

Why some servers allow non-premium players

The main reason is reach. A Java license is a real cost for younger players without a payment method and in places where a game costs a large share of a monthly budget, and some owners want those players too.

Mode	Listed	Playable now	Players now	Players, 7 day average	Busiest hour	Votes, 30 days
PvP	104	50	2,466	3,544	15:00 UTC	12,990
SMP	115	58	2,390	3,517	15:00 UTC	14,150
Cracked	39	19	925	1,587	14:00 UTC	9,260

A server tagged with three modes counts in all three, so the rows overlap and do not add up to the network total.

Measured 19 Oct 2026, 22:55 UTCHow we measure

Cracked is one of the larger tags on our list: as of 18 October 2026, 39 listings carried it, 21 were playable at least once in the 7 days to 17 October, together averaging about 1,530 players, and they received about 9,500 votes in the 30 days before. Live: 39 listings, 21 playable in the last 7 days, 1,587 players on average and 9,260 votes in 30 days.

The trade-off for owners is extra work. Without an account check, a script can join with thousands of made-up names for free, so cracked servers need anti-bot protection, and every account needs a password because no name proves anything.

The real risks

Someone else using your name

On an offline-mode server without a login plugin, anyone can join under any name, including yours or a staff member's. They could empty your inventory, spend your money or get you banned by behaving badly as you. A login plugin fixes this by tying each name to a password, but only after the name is registered. If someone registers your usual name on a server before you do, it is theirs there. Players with paid accounts run into this too, which is why premium auto-login (below) matters.

Passwords on /register

Most cracked servers ask you to register the first time you join and log in every time after, usually with a plugin such as AuthMe:

1. Type /register <password> <password>. Many servers want the password twice, some only once. The chat prompt tells you which.
2. On every later visit, type /login <password> within the time limit, or the server disconnects you.
3. To change it later, type /changepassword <old> <new>.
4. If the server offers it, add an email for recovery with /email add <email> <email>.

Two facts decide how careful to be. The owner runs the server software, so a dishonest owner could log what you type. And on a vanilla offline-mode server the connection is not encrypted, so the password crosses the network as plain text. Neither makes a server malicious, but the password you type there should exist nowhere else. Never use your Microsoft, email or Discord password on a cracked server.

Cracked launchers and malware

Joining without a paid account needs an unofficial launcher, and that is where the bigger risk sits. An unofficial launcher is a program from a source you cannot check, running with access to your files, your browser and your saved logins. "Free Minecraft" downloads are a common disguise for password stealers. Mods have shown how bad this gets: in June 2023, malware known as fractureiser was slipped into mods and plugins on popular download sites, and it stole browser logins and Discord, Microsoft and Minecraft account tokens. Any program you run gets that kind of access. We do not link launchers and we do not recommend any. If you are a parent and your child asked for a free launcher, our guide for parents covers the conversation.

How good offline-mode servers protect players

A well-run cracked server does most of this, and you can ask about each point in its Discord:

• A login plugin (AuthMe Reloaded, nLogin, LibreLogin, JPremium and others) that requires /register and /login, with a time limit and a cap on wrong attempts.
• Premium auto-login. If your name belongs to a paid account, the server checks it with Mojang like an online-mode server would and skips the password. Depending on the plugin and its settings, this can also stop others from registering premium names.
• Hashed passwords. Mainstream login plugins store a hash instead of the password itself.
• Recovery and extras. Email recovery, and on some servers two-factor codes (AuthMe has /totp).
• Anti-bot protection on join, so bot floods do not drown the server.
• Locked-down backends. On a network, the game servers accept connections only from the proxy, so nobody can connect straight to a backend under a staff name.
• Staff who never ask for your password. Anyone who does, staff badge or not, is trying to steal your account.

When we read the descriptions of all 39 listings tagged cracked on serverlist.net on 18 October 2026, none said how the server protects accounts: no login plugin named, no auto-login, no recovery process. That does not mean they lack them. It means you have to ask before you put time into a server.

Do you need to buy Minecraft to play on servers?

For most servers, yes. Servers in online mode, which is the default and what most public servers use, only accept players with a Java Edition license on their Microsoft account. Mojang's EULA puts it simply: "When you buy our games, that means you can download, install, and play them." One purchase covers both editions on PC (it is sold as Minecraft: Java & Bedrock Edition for PC), and it is also included in some Xbox Game Pass plans for PC. On Bedrock, cracked servers are much rarer, because Bedrock servers check Xbox accounts by default and Bedrock players sign in with a free Microsoft account for online play anyway. Once you have the game, joining a Java server takes about a minute.

Voting with an offline-mode name

On most servers, a vote on serverlist.net checks the username you type: first against Mojang's list of Java accounts, then against Bedrock names through lookup services such as GeyserMC's. A name that matches neither is an offline-mode name. We accept offline-mode names only on servers whose owner asked for it and an admin approved, because otherwise anyone could vote under made-up names. On those servers the account check is skipped, and any name in the usual Java format of 3 to 16 letters, numbers and underscores counts. As of 18 October 2026, 2 of the 39 cracked listings had it switched on (live: 2 of 39).

If your server has not enabled it, your vote with an offline name is refused, and the owner can request it from their dashboard. If your offline name happens to match a paid Java account, the vote goes through as a Java name and the server's reward plugin pays out to whoever plays under that name on that server. The same rolling 24-hour cooldown applies either way, and how server voting works covers the rest.

FAQ

Can a cracked server see my password?

Assume it can. A good login plugin stores only a hash, but the owner controls the software and the connection is not encrypted. Use a password that exists nowhere else, and change it if you stop trusting the server.

Can premium players join cracked servers?

Yes. A paid copy of the game can join any offline-mode server. If the server has premium auto-login, you can usually skip /login and your name is protected. If it does not, you register like everyone else, and your skin may only show if the server runs a skin plugin.

Are cracked servers allowed?

Offline mode is a setting in Mojang's own server software, and legitimate networks use it behind a proxy every day. The EULA never mentions offline mode. It does say you can play the game when you buy it, and that hacked versions of the game client are not okay to distribute. So a server that accepts unverified names sits in a gray area Mojang has never spelled out, while playing with a pirated copy is not covered by the license. On serverlist.net, cracked servers can be listed and carry the cracked tag, so you know what you are joining before you join.