Login+

# 🔐 Login+

Register once, stay protected forever. Login+ is a modern authentication plugin for offline-mode servers — passwords, sessions, free 2FA and full account protection in one jar for Spigot/Paper 1. 8. 8 → 1. 21+.

Written in Kotlin, runs fully server side, so every client and every client version is supported. No mods, no datapacks, no paid services — drop the jar in, restart, done.

> 🛡️ Your players' passwords are protected with Argon2id — winner of the Password Hashing Competition and OWASP's #1 recommendation. Its memory-hard design makes large-scale GPU brute-force attacks impractical. Passwords are never stored as readable text — not even the server owner can recover them.

## ✨ Features

• 🔑 Argon2id password hashing — the strongest password protection available today, with OWASP-baseline defaults you can raise in the config
• ⏱️ Sessions — reconnect within 15 minutes (configurable) from the same IP and skip the login. Survives server restarts
• 📱 Free 2FA — three flavours:
• - Google Authenticator (TOTP) — works 100% offline, the QR code is rendered on an in-game map item for easy scanning
• - Discord — your own bot DMs the login code
• - Telegram — your own bot sends the login code
• 🚨 Security alerts — players with Discord/Telegram linked get warned about new-IP logins, brute-force attempts and password changes — even while offline
• 🙈 Console password shield — `/login` and `/register` are intercepted so passwords never appear in the console or log files
• 🧱 Full freeze before login — no moving, chatting, commands, damage, inventory or item pickup; optional blindness and spawn teleport that hides base coordinates from stream snipers
• 🤖 Anti-bot & brute-force protection — per-player attempt limits, per-IP lockouts, join-flood lockdown, username regex filter, per-IP account limits
• 🎭 Anti-impersonation — kicks `NoTcH` if the account was registered as `Notch`, blocks duplicate names, optional UUID checks
• 💎 Premium mode — `/premium` lets verified Mojang accounts skip the password (only when the connection can actually be verified — Login+ never pretends)
• 📧 E-mail recovery — forgot the password? A one-time code is mailed via your own SMTP mailbox. 2FA still applies after recovery
• 🌍 Country filter — whitelist or blacklist joins by country
• 🌐 Proxy ready — works behind Velocity, BungeeCord and Waterfall; with shared MySQL, sessions carry across backend servers (no re-login when switching). Login+ checks your forwarding setup on startup and prints hints
• 🔊 Sound feedback — level-up chime on success, buzzer on wrong password (cross-version safe)
• 🗄️ SQLite out of the box, MySQL for networks — with automatic scheduled backups
• 🌏 Fully translatable — clean English and Russian message files included

## ⚙️ Commands & Permissions

| Command | Permission | Short Description | |---|---|---| | `/register ` | `loginplus.player.register` | Create an account | | `/login ` (alias `/l`) | `loginplus.player.login` | Log in | | `/logout` | `loginplus.player.logout` | Log out and lock the account | | `/changepassword ` | `loginplus.player.changepassword` | Change password | | `/unregister ` | `loginplus.player.unregister` | Delete own account | | `/2fa setup ` | `loginplus.player. 2fa` | Enable two-factor auth | | `/2fa ` | `loginplus.player. 2fa` | Enter the code during login | | `/email set