How to whitelist a Minecraft server
A whitelist turns your server into an invite list. Anyone not on it is refused at the door, which is the simplest protection there is against griefing and the only one that works before someone is already inside.
Turning it on
Two ways, and they do the same thing. In game or from the console:
/whitelist onOr stop the server, set white-list=true in server.properties, and start it again. The command is easier because it takes effect immediately and writes the property for you.
Turning it on does not kick anyone already connected. Run /whitelist reload after editing the list by hand, and /kick anyone online who should not be.
Adding and removing players
/whitelist add Notch
/whitelist remove Notch
/whitelist list
/whitelist offOn an online-mode server the name is resolved against Mojang, so it has to be spelled correctly but the player does not need to have joined before. That is what lets you whitelist someone in advance.
Operators bypass the whitelist entirely. If you are testing whether the whitelist works, test with an account that is not an operator, or you will conclude it is broken when it is not.
whitelist.json
The list lives in whitelist.json next to your world folder:
[
{
"uuid": "069a79f4-44e9-4726-a5be-fca90e38aaf5",
"name": "Notch"
}
]Editing it by hand is how you bulk import a list. The UUID is what actually matters, since the name is only there so the file is readable. Edit while the server is stopped, or run /whitelist reload after saving.
The offline UUID tool generates the UUIDs an offline-mode server uses, which are derived from the username rather than issued by Mojang.
Whitelisting on Bedrock and in offline mode
Bedrock dedicated servers use allowlist.json and the allowlist command, with allow-list=true in server.properties. Same idea, different spelling.
In offline mode the whitelist still works but it protects far less, because usernames are not verified. Anyone can connect claiming to be a whitelisted name unless a login plugin is also in place. If your server runs offline mode, read our cracked server page for what that actually changes.
What a whitelist does not solve
It controls who gets in, not what they do once inside. A whitelisted griefer is still a griefer. Land claims, a rollback plugin and a backup schedule are what limit the damage, and none of them are replaced by an invite list.
It also costs you growth. A whitelisted server cannot be joined by someone who found your address on a list, so if you want players, publish a Discord where people can apply and keep the wait short. Our guide on getting players covers the rest of that.