What nLogin is

nLogin is an authentication plugin designed for performance and security. On offline-mode servers (servers that don't verify accounts with Mojang), players have to register and log in so that nobody else can get into their account. nLogin handles this process faster than the older AuthMe, thanks to optimized database queries and asynchronous processing.

nLogin handles hundreds of simultaneous logins with no noticeable impact on the server's TPS.

nLogin is available on SpigotMC. The free version covers the basics, and the Premium version adds a web panel and extended anti-bot protection.

Login commands

Command	What it does	Permission
`/register password password`	Registers a new account (enter the password twice)	default for everyone
`/login password`	Logs in to an existing account	default for everyone
`/changepassword old new`	Changes the password	nlogin.changepassword
`/unregister password`	Deletes your own account	nlogin.unregister
`/nlogin reload`	Reloads the configuration	nlogin.admin
`/nlogin unregister Player`	An admin deletes a player's account	nlogin.admin
`/2fa`	Turns two-factor verification on/off	nlogin.2fa

A player who isn't logged in can't move, chat, break blocks or interact with the world. They have a limited time to log in (60 seconds by default), after which they are kicked from the server.

Anti-bot protection

nLogin includes built-in protection against bot attacks, where bots try to mass-join the server and register fake accounts. nLogin's anti-bot system includes:

CAPTCHA - the player has to type a random code shown on a map before they can register
Rate limiting - limits the number of login attempts from one IP within a set time
Account limit per IP - the maximum number of accounts registered from one IP address
Automatic blocking - an IP that produces too many failed attempts is blocked automatically
Anti-VPN - optional blocking of VPN and proxy connections (requires an API key)

Anti-bot protection is especially important on offline-mode servers, which are the main target of botnet attacks. Without it, a server can be flooded with hundreds of fake accounts within minutes.

Two-factor verification (2FA)

nLogin offers optional two-factor verification through TOTP apps (Google Authenticator, Authy). The player enables 2FA with the /2fa command and scans the QR code shown on a map in the game, and from then on has to enter the six-digit code from the app at every login.

2FA significantly raises account security on offline-mode servers, where passwords tend to be simple and easy to guess. Admins can enforce 2FA for staff (moderators and admins) while keeping it optional for regular players.

Configuration

The main configuration file is plugins/nLogin/config.yml. The key settings:

# Database
database:
  type: MYSQL          # SQLITE or MYSQL
  host: "localhost"
  port: 3306
  database: "nlogin"
  username: "nlogin"

# Security
security:
  max-accounts-per-ip: 3
  login-timeout: 60         # seconds to log in
  bcrypt-rounds: 12         # password hashing strength
  captcha-on-register: true

# BungeeCord / Velocity
bungeecord:
  enabled: false
  auth-server: "lobby"     # the server where login takes place

On BungeeCord/Velocity networks, login takes place on a dedicated server (usually the lobby). After a successful login, the player is automatically moved to the main server. This requires a shared MySQL database.

nLogin vs AuthMe

nLogin and AuthMe are the two login plugins most often compared. The main differences:

Performance - nLogin is noticeably faster with a large number of simultaneous logins thanks to fully asynchronous database operations
Velocity - nLogin supports Velocity natively, while AuthMe needs a fork or additional plugins
CAPTCHA - nLogin has a built-in CAPTCHA on maps, while AuthMe needs additional plugins
Popularity - AuthMe has a bigger user base and more guides, while nLogin is growing in popularity
Support - both plugins are actively developed

If you run a server that needs its own login system, nLogin is the better choice for a new setup because of its modern architecture and native support for newer platforms. AuthMe works well if you need compatibility with older plugins or are migrating from an existing installation.

Related plugins: AuthMe, LuckPerms (permissions).