Minecraft RCON Password Generator
Generate a secure RCON password for your Minecraft server along with ready to paste server.properties lines, a Docker (itzg/minecraft-server) command and an mcrcon command that runs over an SSH tunnel. Everything is generated in your browser.
People search "Minecraft server password" expecting a box where players type a password to join. Vanilla Java Edition doesn't have that. The RCON password is not it either. RCON is a remote admin console: a TCP port that accepts server commands (/op, /stop, /whitelist, all of it) from anyone who knows the password. It lets you run commands without attaching to the server's terminal, and backup scripts use it to pause saving. It does nothing to stop players from joining.
So there are two separate jobs here:
- Control who can play: whitelist plus online mode.
- Protect the admin console: a strong RCON password, and RCON kept off the public internet.
The whitelist is the lock. These are the server.properties settings that matter:
| Property | What it does |
|---|---|
white-list=true | Only players on the whitelist (and ops) can join. |
enforce-whitelist=true | When the whitelist changes, online players who are no longer on it get kicked. |
online-mode=true | Players must be verified against Minecraft's account servers. This is what makes names on the whitelist mean anything. |
Then add your players from the server console or in game as an op:
/whitelist on
/whitelist add SomePlayer
/whitelist remove SomePlayer
/whitelist list
/whitelist reload
/op YourNameOps can always join while the whitelist is on, even if they aren't listed, so be stingy with /op. Ops can also run every command RCON can.
The server.properties side is three lines:
enable-rcon=true
rcon.port=25575
rcon.password=YOUR_GENERATED_PASSWORDDefaults: enable-rcon is false, rcon.port is 25575, and rcon.password is blank. If RCON is enabled with a blank password, it won't start.
A long random password handles the guessing. Nothing a password can do handles the plain text. So:
- Don't forward 25575 on your router. Only the game port (25565 by default) needs to be reachable by players.
- Firewall it on a VPS. With ufw:
sudo ufw allow 25565/tcpandsudo ufw deny 25575/tcp. - In Docker, publish only the game port or publish RCON to localhost with
-p 127.0.0.1:25575:25575. Docker-published ports skip ufw rules.
server.properties is read as a Java properties file. A backslash starts an escape sequence, and leading spaces are dropped. Colons, equals signs, hash and exclamation marks work but Minecraft rewrites them with a backslash in front. That is why this generator defaults to A-Z, a-z and 0-9.
| Written in the file | Password that worked | Lesson |
|---|---|---|
ab\cd | abcd | A backslash escapes the next character and disappears. |
x\ty | x, a tab, y | \t becomes a real tab. |
end\\ | end\ | Write \\ for one backslash. |
ab:c=d#e!f | ab:c=d#e!f | Works, and the server rewrote the line as ab\:c\=d\#e\!f. |
The file isn't the only parser in the chain. The password also passes through your shell, maybe a Compose file, maybe a .env file, maybe a backup script. Each has its own rules for $, quotes, backslashes and !. If you pick the all-symbols mode, the generator escapes \ : = # ! in the properties line.
- RCON is enabled by default, because the image uses it for clean shutdowns and for coordinating saves during backups.
- If you don't set RCON_PASSWORD, it generates a random password at each startup. That's safe, but outside tools can't know it.
- Set RCON_PASSWORD, or RCON_PASSWORD_FILE pointing at a file (handy with Docker secrets).
- The container ships rcon-cli, already configured with the password.
docker exec mc rcon-cli listjust works. - Be cautious of mapping the RCON port externally.
- No RCON. The Bedrock Dedicated Server has no RCON setting in server.properties.
- Allowlist, not whitelist. Set allow-list=true and manage allowlist.json with the allowlist command. Unlike Java, being an operator doesn't get you past the list.
online-mode=truerequires Xbox Live authentication.
Change the RCON password when someone with access leaves, when it has ever been typed into a chat or a screenshot, or when you find the port was exposed.
- Forwarding 25575 "so the panel works" - use a tunnel or put the panel on the same machine.
- Reusing the password from your hosting account or anything else. RCON sends it in plain text, so assume it can leak.
- Committing it to git in a Compose file. Use RCON_PASSWORD_FILE or an untracked .env.
- Treating the RCON password as a join password. Players will still walk right in without a whitelist.
- Pasting a backslash into server.properties and wondering why the password doesn't work.