SafeLoginSTG

Hybrid authentication plugin for Paper / Purpur.

Premium (Mojang) usernames and cracked usernames share one flow: Paper Dialog UI for password create/login, PBKDF2 hashed storage, and optional client cookies when the same name switches between premium and cracked clients.

Plugin version	1.0.1
Supported servers	1.21.11, 26.1, 26.1.2, 26.2, 26.3
Organization	STG-SERIES
License	All rights reserved (private)

---

Downloads

Use the JAR that matches your server version (folders under dist/):

Server	Folder	Java
1.21.11	dist/1.21.11	21+
26.1	dist/26.1	25+
26.1.2	dist/26.1.2	25+
26.2	dist/26.2	25+
26.3	dist/26.3	25+

GitHub Releases publish one tag per platform build (e.g. v1.0.1-26.2).

---

Features

• Mojang premium check — usernames that exist on Mojang follow the premium path
• Cracked accounts — create a password on first join; enter it every later join
• Premium first join — create a password once; later joins auto-login
• Native Dialog UI — register / login screens (Paper Dialog API)
• Secure storage — PBKDF2-HMAC-SHA256 hashes in accounts.yml (never plaintext)
• OP-only admin commands — set or reset passwords
• Unauthenticated lockdown — movement, chat, commands, interact, combat blocked until auth succeeds

---

Installation

1. Pick the JAR for your Paper/Purpur version from dist/<version>/ or Releases.
2. Copy it into plugins/.
3. Start (or restart) the server.
4. Edit plugins/SafeLoginSTG/config.yml if needed.

For hybrid cracked + premium, use online-mode=false.

---

Commands

All /SLSTG commands are OP-only (console / RCON allowed).

Command	Description
/SLSTG setpswd <player> <new password>	Sets a new hashed password
/SLSTG reset <player>	Deletes the account; next login is first-time signup

---

Permissions

Permission	Default	Description
safeloginstg.admin	op	Admin commands (runtime also requires OP / console)
safeloginstg.bypass	false	Skip authentication entirely

---

Configuration

min-password-length: 4
max-password-length: 64
auth-timeout-seconds: 120

---

Building from source

Requires a JDK that can target 21 and 25 (JDK 25+ recommended; JDK 26 works).

./gradlew buildAll

Outputs:

dist/1.21.11/SafeLoginSTG-1.0.1-1.21.11.jar
dist/26.1/SafeLoginSTG-1.0.1-26.1.jar
dist/26.1.2/SafeLoginSTG-1.0.1-26.1.2.jar
dist/26.2/SafeLoginSTG-1.0.1-26.2.jar
dist/26.3/SafeLoginSTG-1.0.1-26.3.jar

Single version:

./gradlew :versions:26.2:build

---

Version docs

Version	Document
1.0.1 (current)	docs/versions/v1.0.1.md
1.0.0	docs/versions/v1.0.0.md
Index	docs/versions/README.md

---

Project layout

SafeLoginSTG/
├── src/main/java/...          # Shared sources
├── versions/
│   ├── 1.21.11/               # Paper API build for 1.21.11
│   ├── 26.1/
│   ├── 26.1.2/
│   ├── 26.2/
│   └── 26.3/
├── dist/<version>/            # Built JARs + per-version README
├── docs/versions/             # Release documentation
└── README.md

---

Support

Private project under STG-SERIES. Contact maintainers in the organization for issues and updates.