Does an Anticheat Work on Cracked or Offline-Mode Servers?

Does an anticheat work on an offline-mode server?

It depends on the anticheat's documentation and your setup. The online-mode setting changes identity. With online-mode=false, the server does not verify accounts with Mojang, so name-based and UUID-based records are easier to evade. Check how the anticheat treats offline UUIDs before you launch.

Cracked clients raise separate risks that an anticheat cannot remove. This page describes those risks neutrally and does not endorse them.

Risks to weigh before you decide

Each row below is a separate question. Answer each one for your server before you open it to players.

How identity changes in offline mode

In offline mode, the server does not ask Mojang to confirm who is logging in. The player's UUID is derived from the username, so anyone who uses that name arrives with the same UUID. Any record keyed to that UUID now describes a name, not a verified account.

This matters most for bans, staff notes, economy balances, and any anticheat feature that stores history per player. Those records stay useful only if you accept that a name can be taken over or reused. A whitelist limits who joins by name, but it does not prove who controls a name.

What to look for in logs and configuration

Start with the settings that decide how identity reaches the server. A proxy in front of the server often controls authentication, so check the proxy configuration as well as the server file.

• The online-mode value in server.properties, and whether it matches the value your notes say it should be.
• Proxy authentication and forwarding settings, if a proxy sits in front of the server.
• Join log lines that show a username and UUID pair, so you can see whether the same name ever maps to two UUIDs.
• Whitelist and ban files, to confirm which entries use names and which use UUIDs.
• Any authentication plugin, and its own log of login attempts.

# server.properties (placeholder: confirm the value you need)
online-mode=false

A numbered setup check for offline-mode servers

Run these checks on a staging copy before any player joins the live server.

• Download the server and each plugin only from official sources, and verify checksums.
• Set online-mode in server.properties and record the value and the date in your change log.
• Join with two test accounts and confirm each receives a separate UUID.
• Ban one test account, then confirm the ban applies to the expected identity and not to a shared name.
• Confirm in the anticheat documentation how it handles offline-mode UUIDs and whether any check behaves differently.
• Write down any identity limit you accept, and tell staff how it affects bans and appeals.

Edge cases that change the answer

Bedrock players who connect through Geyser with Floodgate reach the server through a different identity path. Test them separately, and do not assume that a Java offline-mode result applies to them. Floodgate identifies Bedrock players, and Geyser translates their packets, so the two layers need their own checks.

A proxy with its own authentication can make the server behave as though it were online-mode even when the backend is set to offline. Confirm the full chain before you trust any identity record.

Which setup fits which goal

Pick the row closest to your goal. Each row trades convenience against how much identity you can rely on.

What we have not verified

We have not tested any anticheat on an offline-mode server. Behavior depends on the anticheat version, any proxy in front of the server, and authentication plugins. Check the documentation for your exact stack, and run the setup check above before you open the server.