Whitelist (Minecraft)

A whitelist is the velvet rope for your Minecraft server: nice for keeping strangers out, awkward when you forget to put yourself on the list.

The short answer

The Minecraft whitelist is a list of players who are allowed to join a server. With it switched on, only the named players can connect [2]. It is stored in whitelist.json and managed with the /whitelist command or by editing the file [1][2]. It is the simplest access control a Minecraft server has, but it only works as well as the identity check behind it: with online-mode=false, a name is all it takes [3][4].

How it works

1. The switch. The setting white-list in server.properties turns the whitelist on [2]. The wiki's property table lists true as its default, and the command page notes that since Java Edition 26.3 snapshot 2 the whitelist is on by default [1][3]. Check your own file instead of trusting memory.
2. The file. Each entry in whitelist.json has two fields, uuid and name. The UUID identifies the player's account; the name is the username [2].
3. The commands. Operators manage the list with /whitelist. If you edit the file by hand while the server runs, /whitelist reload makes the change take effect [2]. The command needs permission level 3 on Java Edition [1].
4. Operators. On Java Edition, server operators can always connect while the whitelist is active, even if they are not on it. On Bedrock Edition, players must be whitelisted regardless of operator status [1].
5. Kicking people. The property enforce-whitelist defaults to false. With it off, players who are already online are not kicked when you remove them. With it on, players not on the list are kicked after the server reloads the whitelist file [3].
6. Online mode matters. With online-mode=false, the server does not check accounts against Mojang. The wiki warns that anyone with a fake account can connect in that case [3]. The vanilla server then derives an offline UUID from the string OfflinePlayer:<name> [4], so a whitelist entry for a name protects nothing when others can type that name. Our assessment: keep online mode on for any public server, and treat the whitelist as an add-on, not a lock.

A server example

Our inventory (as of 14 to 16 Oct 2026) records no whitelist configuration for any of our servers, so this is an invented friends server. You start the server for the first time and the whitelist is already on, so nobody but operators can join. You run /whitelist add for each friend, using the exact usernames. Later you remove one friend, and you set enforce-whitelist=true so that a friend who is online at that moment is also removed after the reload [3].

Checklist

• Read white-list and enforce-whitelist in your own server.properties [3].
• Add yourself and every operator account before you restart [1].
• Keep online-mode=true on any server that is reachable from the internet [3].
• Edit whitelist.json only with the server stopped, or run /whitelist reload afterwards [2].
• Use exact usernames when you add players and check the entry in whitelist.json afterwards (our assessment) [2].
• Remember that Bedrock servers use the same command and name it /allowlist as an alias [1].