Token-basierter Minecraft-Session-Switcher für Fabric 1.21.11. Multi-Account-Manager, verschlüsselter Vault und Privacy-Toggles, damit deine Alts nicht über denselben Rechner korreliert werden können.
Installation · Features · Commands · Settings · Vault · Build · Changelog
SessionLogin lets you paste a Minecraft session token ("session ID") and instantly swap the active session in memory — no relaunch, no Microsoft re-login. On top of the basic switcher it adds a saved multi-account manager, an encrypted token vault, and a set of privacy toggles so two accounts on the same machine can't be linked by their cached resource packs, client brand, or telemetry.
Every network call goes to the official api.minecraftservices.com and
nowhere else. No email/password field anywhere — accounts are keyed
purely by token.
- Paste a session token → session swapped in memory; original is preserved and restorable.
- Tolerant pasting: strips
Bearerprefix and trailing:UUIDsuffix, one-click Paste from clipboard, Enter-to-login. - Login runs off the render thread — no UI freeze, clear green ✔ confirmation, Minecraft toast.
- Edit account: change username / skin via official Mojang API.
- Two account types: session-token (online) and offline / cracked (username + canonical OfflinePlayer UUID).
- Token expiry parsed from the JWT
expclaim, colour-coded. - Background validity check (✔ / ✘) cached so Mojang isn't spammed.
- Search (label / username / notes) and sort (recent / name / expiry).
- Custom label + notes per account.
- Bulk import from the clipboard (one token per line).
- Import / Export the whole encrypted vault as a single portable JSON file.
- Import from launchers — pulls accounts directly out of the
official Minecraft Launcher's
launcher_accounts.jsonand the Modrinth App's bundled SQLite database (minecraft_userstable), in one click.
- Isolate pack cache per account (default ON) — each session UUID
gets its own
server-resource-packs/<uuid>/subfolder. Idea from LiquidBounce / OpSec. - Spoof brand as Vanilla (default OFF) — report
vanillainstead offabric. - Block Mojang telemetry (default ON) — drop telemetry events on the client.
For deeper anti-tracking (sign translation, channel spoofing, known-pack filtering, key resolution, chat-signature stripping) stack SessionLogin with OpSec or ExploitPreventer — complementary, not competing.
/slcommand —list,current,switch <label>,restore.- Open-anywhere keybind (Controls → Misc → Open Account Manager).
- In-world HUD warning
⚠ Alt: <name>on a swapped session. - SystemToast on every login / switch.
- Optional ModMenu integration (soft dep).
- Install Fabric Loader for Minecraft 1.21.11.
- Install matching Fabric API.
- Download
sessionlogin-1.3.5.jarfrom the Releases page and drop it into yourmods/folder. - (Optional) Install ModMenu.
- Launch the game.
- Multiplayer screen → top-right Login button.
- Paste a session token (or click Paste for the clipboard).
- Press Login (or Enter) → ✔ Logged in as <name> + toast.
- Optional: Save to accounts for one-click switching later.
- Accounts opens the manager. Click a row to switch, Use Original to restore.
| Command | Description |
|---|---|
/sl |
Print the available subcommands. |
/sl list |
List every saved account with [expiry] and badge. |
/sl current |
Show which account is currently active. |
/sl switch <label> |
Switch by label or username (tab-complete). |
/sl restore |
Restore the original session. |
Open via Settings in the Account Manager or via ModMenu.
Persisted to config/sessionlogin/settings.json.
| Setting | Default | Description |
|---|---|---|
| Isolate pack cache per account | ON | Per-UUID subdirectory for server resource-pack downloads. |
| Spoof brand as Vanilla | OFF | Report vanilla instead of fabric. |
| Block Mojang telemetry | ON | Replace the telemetry sender with NOOP. |
| Show toasts on login / switch | ON | Pop a Minecraft-style toast. |
Saved tokens are encrypted at rest. Pick a mode in the Vault screen:
| Mode | Key location | Portability | Protection level |
|---|---|---|---|
| Local (default) | config/sessionlogin/.key (random) |
Local only | Obfuscation — anyone with file access can decrypt. |
| Master password | Derived in memory via PBKDF2 (210k iters) from your password + salt | Portable — accounts.json + meta.json can be moved to another PC and unlocked with the password |
Genuine encryption — no secret on disk. |
Forget the master password → no recovery. Switch back to local mode any time while unlocked.
All HTTP calls go to api.minecraftservices.com only, via the JDK's
built-in java.net.http.HttpClient (no external HTTP library bundled).
Requires JDK 21.
./gradlew buildOutput jar: build/libs/sessionlogin-<version>.jar.
src/main/java/dev/elv1n200/sessionlogin/
├── SessionLogin.java ─ main entrypoint (vault, store, settings)
├── SessionLoginClient.java ─ client entrypoint (keybind, HUD, command)
├── account/ ─ Account model, AccountStore (encrypted)
├── command/ ─ /sl client command
├── config/ ─ Settings (persisted toggles)
├── mixin/ ─ MinecraftClient (session swap),
│ Downloader (per-UUID pack cache),
│ ClientBrandRetriever (vanilla spoof),
│ TelemetryManager (NOOP sender),
│ MultiplayerScreen (buttons + indicator)
├── modmenu/ ─ optional ModMenu integration
├── screen/ ─ all GUI screens
├── util/ ─ ApiUtils, TokenUtils, CryptoUtils,
│ SessionUtils, Notifier, FormattingUtils
└── vault/ ─ VaultManager (local / master-password)
Concepts inspired by:
- LiquidBounce — per-account pack cache isolation.
- OpSec — synthesises and extends the privacy techniques used here.
- ExploitPreventer — local-URL / fingerprinting research.
- No Chat Reports — telemetry-blocking approach.
- Meteor Client — session-token login flow.
Independent implementation, not a fork.
CC0-1.0 — public domain. Do whatever you want.