--- title: "Minecraft \"Failed to verify username!\": What Causes It and How to Fix It" description: "Failed to verify username is not a password check. What the server really asks Mojang, the four causes in order, and why online-mode=false is no fix." url: "https://www.gameserverkings.com/knowledge-base/minecraft/error-failed-to-verify-username/" category: "Minecraft" category_url: "https://www.gameserverkings.com/knowledge-base/minecraft/" published: "2026-08-19T09:24:51.672Z" updated: "2026-08-19T09:34:00.333Z" source_format: "markdown" site: "GameServerKings" --- # Minecraft "Failed to verify username!": What Causes It and How to Fix It The player sees one short sentence and nothing else: ```text Failed to verify username! ``` And your console records the matching line: ```text title="Console output" [User Authenticator #1/ERROR]: Username 'Steve' tried to join with an invalid session ``` Both are verbatim from the 26.2 server jar. The message is widely misread as "wrong password", which Minecraft does not have, and that misreading sends people straight to the one change they should not make. This page covers what the server actually asked, and what the four real causes are. For the full lookup of every join-time rejection, see [Minecraft Players Can't Connect](/knowledge-base/minecraft/players-cant-connect/). ## What the Server Actually Did `online-mode` defaults to `true`. When it is on, joining works like this: 1. The client and server negotiate an encrypted connection and derive a shared secret. 2. Both sides compute a hash from that secret plus a server ID. 3. The **client** tells Mojang's session service: I am joining a server with this hash. 4. The **server** then asks Mojang's session service: has this username joined a server with this hash? If step 4 comes back with a profile, the player is in and the console logs `UUID of player Steve is …`. If it comes back **empty**, the server disconnects them with `Failed to verify username!`. > [!IMPORTANT] An empty answer is not a rejection > Mojang does not say "wrong credentials". It says "I have no record of that". That single fact reorders the whole diagnosis: the question is not *what did the player get wrong*, it is *why did the client's claim and the server's question never meet*. Most of the time nobody typed anything incorrectly. There is a separate failure path for when Mojang itself is unreachable, and it produces different text on both sides — see [Mojang is down](#mojang-is-down-a-different-message) below. If you are seeing that one, none of the causes here apply. ## Cause 1: An Offline or Cracked Client The client never performed step 3, because it has no legitimate account to perform it with. Mojang therefore has no record, and the server refuses. **Check:** does the same player get in on someone else's genuinely purchased account? Does everyone else connect normally? If yes to both, this is it. **Fix:** the player needs a real Minecraft account. This is the intended behaviour of an online-mode server and there is nothing to repair. ## Cause 2: A Proxy in Front, With the Backend Still Checking This is the cause that produces the most confused tickets, and it is entirely a configuration mistake rather than anything a player did. When a Velocity or BungeeCord proxy sits in front of your servers, **the proxy performs the authentication**. The client's claim in step 3 is made against the *proxy's* server ID. If a backend server behind it still has `online-mode=true`, that backend asks its own step-4 question using a *different* hash — and gets an empty answer, every single time, for every legitimate player. **Check:** are you running a proxy at all? If so, look at `online-mode` in the `server.properties` of the backend the player was being sent to. **Fix:** backends behind a proxy must have `online-mode=false`, with the proxy doing the checking and forwarding player identity. That is only safe when the backends are not reachable directly, which is why the forwarding setup matters as much as the flag — [Minecraft Server Networks: Setting Up a Velocity Proxy](/knowledge-base/minecraft/multi-server-networks-with-velocity/) covers the whole arrangement. > [!NOTE] Behind a proxy, the wording changes > Neither proxy uses Minecraft's sentence, so the message your player quotes tells you which component rejected them. Velocity says `You are not logged into your Minecraft account. If you are logged into your Minecraft account, try restarting your Minecraft client.` BungeeCord says `Not authenticated with Minecraft.net`. If you see either of those, the rejection came from the proxy — the backend was never reached. Two neighbouring proxy messages are worth recognising while you are here. Velocity's `Your server did not send a forwarding request to the proxy. Make sure the server is configured for Velocity forwarding.` means the backend is not set up for modern forwarding. Paper's `If you wish to use IP forwarding, please enable it in your BungeeCord config as well!` is the BungeeCord-side equivalent. ## Cause 3: `prevent-proxy-connections` Is On `prevent-proxy-connections` defaults to `false`. Turn it on and the server includes **the IP address the player is connecting from** in its step-4 question, so Mojang can compare it against the address it saw in step 3. That is the entire feature. It is intended to stop one account being shared across the world, and the way it fails is that plenty of ordinary players legitimately appear on two different addresses: anyone on a VPN, on mobile data, on carrier-grade NAT, or on an ISP that load-balances across egress addresses. **Check:** read `prevent-proxy-connections` in `server.properties`. If it is `true` and rejections look random rather than universal, this is almost certainly it. **Fix:** set it back to `false` and restart. The protection it buys is small and the false-rejection rate is not. ## Cause 4: A Stale Launcher Session — a Different Message Worth listing because people report it as the same thing, and it is not. If the player's launcher session has expired, the failure happens on *their* side, before your server is meaningfully involved, and they see: ```text Failed to log in: Invalid session (Try restarting your game and the launcher) ``` **Fix:** the message is the fix, literally. Quit the game *and* the launcher, sign in again. Common right after switching Microsoft accounts. Nothing on your server needs changing, and nothing appears in your console — which is the giveaway. ## Mojang Is Down — a Different Message When the session service is unreachable rather than unhelpful, the server takes a separate path and both sides say so plainly: ```text Authentication servers are down. Please try again later. Sorry! ``` ```text title="Console output" [User Authenticator #1/ERROR]: Couldn't verify username because servers are unavailable ``` There is nothing to fix. It resolves when Mojang's side does. If your console shows this rather than `tried to join with an invalid session`, stop diagnosing. ## Turning `online-mode` Off Is Not a Fix It will make the message go away, because the server stops checking accounts at all. > [!CAUTION] What `online-mode=false` actually costs you > With the check removed, anyone who can reach your port may connect claiming **any** username — including yours, with your operator level attached to it. The server prints four warnings at every boot saying so, ending with `To change this, set "online-mode" to "true" in the server.properties file.` It is defensible only on a server that is not reachable from the internet, or as a backend behind a proxy that authenticates for it. On anything else, the whitelist becomes the only thing between your world and the first person who types your name — see [Minecraft Whitelist and Ban Management](/knowledge-base/minecraft/whitelist-and-ban-management/). ## When It Is Not the Real Problem - **Everyone is rejected, including you, and you are not running a proxy.** Check `prevent-proxy-connections` first, then whether Mojang is having an outage — the console line distinguishes the two immediately. - **Only one player is rejected.** That is cause 1 or cause 4, not a server setting. Have them try another network and confirm their launcher is signed in. - **The player never gets this far.** A version mismatch, a whitelist rejection, a full server and a ban all produce their own distinct sentences. [Minecraft Players Can't Connect](/knowledge-base/minecraft/players-cant-connect/) is the lookup table for all of them. - **The console shows nothing at all.** Then the rejection did not come from your server. It came from their launcher, or from a proxy in front of you. ## Other Named Errors in This Cluster One page per message, all six indexed from [Reading Minecraft Server Logs and Crash Reports](/knowledge-base/minecraft/reading-crash-logs-and-common-errors/): - `**** FAILED TO BIND TO PORT!` — [Minecraft "Failed to Bind to Port"](/knowledge-base/minecraft/error-failed-to-bind-to-port/) - `Error: Unable to access jarfile` — [Minecraft "Error: Unable to access jarfile"](/knowledge-base/minecraft/error-unable-to-access-jar-file/) - `Connection closed - mismatched mod channel list` — [Minecraft "Connection closed - mismatched mod channel list"](/knowledge-base/minecraft/error-mismatched-mod-channels/) - `java.lang.OutOfMemoryError: Java heap space` — [Minecraft "java.lang.OutOfMemoryError: Java heap space"](/knowledge-base/minecraft/error-out-of-memory-java-heap/) - `Can't keep up! Is the server overloaded?` — [Minecraft "Can't keep up! Is the server overloaded?"](/knowledge-base/minecraft/error-cant-keep-up/) ## What to Read Next - [Minecraft Players Can't Connect](/knowledge-base/minecraft/players-cant-connect/) — every join-time error message, and which cause each one maps to - [Minecraft server.properties: The Complete Reference](/knowledge-base/minecraft/server-properties-reference/) — `online-mode`, `prevent-proxy-connections`, `enforce-secure-profile` - [Minecraft Server Networks: Setting Up a Velocity Proxy](/knowledge-base/minecraft/multi-server-networks-with-velocity/) — proxy authentication and player-info forwarding - [Minecraft Whitelist and Ban Management](/knowledge-base/minecraft/whitelist-and-ban-management/) — the control you actually need if online-mode is off - [Reading Minecraft Server Logs and Crash Reports](/knowledge-base/minecraft/reading-crash-logs-and-common-errors/) — reading the console lines quoted on this page in context --- Made with 💜 by GameServerKings