Articles
How to protect your Minecraft account and the name on it
A Minecraft: Java Edition username belongs to an account, and an account is only as safe as the Microsoft account behind it. Lose control of it and you lose the name too, along with your skins, capes and purchases. A few settings, done once, make that very unlikely.
Your Minecraft account is a Microsoft account
Since the move from Mojang accounts, every Java account signs in with a Microsoft account. Its security settings live at account.microsoft.com, not inside the game. Everything below is done there, typed into the address bar by hand.
Turn on two-step verification
With two-step verification, a password alone is not enough to sign in: Microsoft also asks for a code from an app, a text message or an e-mail. That stops the most common attack, a password reused from another site that leaked. An authenticator app is the strongest choice, and Microsoft's own app can approve sign-ins with one tap. Nobody legitimate will ever ask you for the codes it shows.
Keep your recovery details current
Check that the phone number and the second e-mail address on the account are yours and still work. They are how Microsoft lets you back in if you forget your password, and how it tells you when someone else tries. An old address you no longer read is a door you cannot watch.
Use a password used nowhere else
A long password that you use only for this account means a leak somewhere else cannot open it. A password manager makes that easy. If you have ever used the same password on another site, change it now.
Look at the apps that have access
Signing in "with Microsoft" on another site gives that site a limited access to your account, without your password. That is how many legitimate services work, this site included: you sign in on Microsoft's page, which says what the site is asking for. Your Microsoft account keeps a list of the apps you have allowed, and you can remove any of them at any time. Look at that list now and then, and remove what you do not recognise or no longer use.
Session tokens: the password you do not see
When your launcher signs in, it keeps a token so you do not have to sign in every time. Whoever has that token can act as you, for example to change your name or skin, without knowing your password and without passing your two-step verification. Programs that steal it are hidden in fake mods, fake clients and "free" cracked tools. In 2023 a piece of malware known as Fractureiser spread through mods uploaded to popular sites, which shows that even well-known places can be used.
- Download the launcher only from minecraft.net.
- Install mods and clients from their official pages and well-known sites, and be suspicious of new uploads of popular mods by unknown authors.
- Never paste anything a stranger gives you into a command prompt or the browser's developer tools.
- If you think a token leaked, sign out of every session from your Microsoft account and change your password: the stolen session can then no longer be renewed, and it runs out on its own within about a day.
Watch the activity
The recent activity page of your Microsoft account lists where and when it was used. A sign-in from a country you have never been to is the signal to change the password and sign out everywhere. Microsoft also sends a message when it sees an unusual sign-in: read those, and act on them from the site itself, not from a link in a message you are not sure of.
Know the scams
Most accounts are not broken into: they are handed over, to someone who asked nicely. The article on name scams describes the usual tricks, from fake snipers to codes you are asked to type.
