RCON (Minecraft)

RCON is the spare key to your Minecraft server console. Fine on a key ring, less fine on the front door mat.

The short answer

RCON (remote console) is a TCP/IP-based protocol that lets server administrators run commands on a Minecraft Java server from another machine [1]. It is an implementation of the Source RCON protocol, introduced in Java Edition Beta 1.9 Prerelease 4 [1]. It is switched off by default and needs a password [2]. The wiki warns that RCON is not encrypted and that it is dangerous to expose its port to the internet [1]. Our assessment: use RCON only inside your LAN or through an encrypted tunnel.

How it works

1. Enable it. In server.properties you set enable-rcon=true, a password in rcon.password and optionally a port in rcon.port. The default port is 25575 [1][2].
2. Safeguard. If the password is blank and RCON is enabled, the server does not start RCON [2]. Also, enable-rcon defaults to false, so a fresh server has no RCON listener [2].
3. Protocol. A client sends a login packet with the password, then command packets. A request ID of -1 in the reply means that authentication failed [1]. Output can be split over several packets of up to 4096 bytes [1].
4. Clients. Many libraries implement the protocol. The small command-line tool mcrcon reads host, port and password from the environment variables MCRCON_HOST, MCRCON_PORT and MCRCON_PASS and starts in terminal mode if you give it no command [5].
5. A tunnel for safety. SSH can carry the connection. The LocalForward option in ssh_config forwards a local TCP port over the encrypted channel, and a bind address of localhost keeps the listening port local to your machine [4]. You then point the client at localhost.
6. The newer route. Recent Java versions also have a Minecraft Server Management Protocol. It is disabled by default, listens on localhost by default, has TLS enabled by default and requires a secret of 40 alphanumeric characters [3][2]. Our assessment: it does not replace RCON for older setups, but it is worth knowing if you build tools for current versions.

A server example

Our inventory (as of 14 to 16 Oct 2026) records no RCON configuration, so this is an invented home server. You run Minecraft on a mini PC and want a nightly script to send save-all and stop. You enable RCON with a long random password, keep port 25575 closed to the internet, and run mcrcon on the same machine with the password in MCRCON_PASS [5]. For admin work from your laptop, you open an SSH tunnel first, then run the client against localhost [4]. Do not paste the password into scripts you commit; use an environment variable or a file with restricted access (our assessment).

Checklist

• Set a long, unique rcon.password and never commit it [2].
• Do not forward port 25575 on your router [1].
• Reach RCON through SSH, with LocalForward bound to localhost [4].
• Set broadcast-rcon-to-ops=false if operators should not see RCON commands; the wiki's default file shows true [2].
• Test one harmless command such as list before you automate stop [5].
• On newer versions, look at the management protocol, but keep its secret private [3].