RCON Password Generator

What is an RCON password?

This RCON password generator makes a long random password for the remote console of a Minecraft Java Edition server and writes the three server.properties lines that turn it on. The password is created in your browser with crypto.getRandomValues, the same random source browsers use for encryption keys, and it isn't sent to ChunkPod or anywhere else unless you ask the AI assistant a question. Change the length or the character sets and a new password appears; press "Generate new password" for another one with the same options.

RCON (remote console) lets a program log in to a running server over TCP and run commands as if they were typed into the server console. The password is the only thing that protects that access. Anyone who has it can run any console command: op themselves, stop the server, whitelist off, or wipe inventories. It needs to be long and random, not a word you can remember, because you never type it by hand. It goes into server.properties once and into the tool or script that connects.

Ask the AI assistant

The AI assistant under the generator answers questions about RCON setup: which port to use, how to connect with mcrcon, or why RCON won't start. It gets the lines on this page with your question, password included, so press "Generate new password" afterwards if you want one that has never left your browser. It's free, with 20 questions a day.

The server.properties settings

RCON is controlled by four keys in server.properties. The tool writes the first three; the fourth is optional.

A few details matter:

• An empty password disables RCON. If enable-rcon=true but rcon.password is blank, the server logs a warning and does not open the port. That is a safety default, not a bug
• The port must be free. Each server on the same machine needs its own RCON port, and it must differ from the game port (server-port, 25565 by default) and the query port. The "Second Server" preset uses 25576 for this reason
• RCON listens on the same address as the game. If server-ip is empty, the listener binds to every network interface on the machine, including the public one. That is why the firewall section below is not optional
• Changes need a restart. server.properties is read at startup, so stop the server, edit the file and start it again

If you are building the whole file, the server.properties generator has the RCON fields next to every other setting, and this password can be pasted straight into it. The server.properties settings guide explains the rest of the file.

Why the password should be long and random

RCON has no second factor, no account and no username. Vanilla Minecraft does not lock out an address after failed logins, so a script that can reach the port can try passwords as fast as the network allows. The only defense is a password with too many possibilities to try.

The generator shows the strength in bits of entropy. Each bit doubles the number of possible passwords:

Anything above about 128 bits is out of reach of any guessing attack. The default of 32 letters and digits is well past that, so there is no need to add symbols for strength. Length does more than character variety: going from 16 to 32 characters adds far more than adding symbols to a 16-character password.

Passwords like minecraft123, the server's name, or the same password as your panel or email are the ones people actually get caught by. Automated scanners look for open port 25575 and try lists of common passwords. A random password from this tool is not on any list.

Symbols and look-alike characters

Symbols are off by default. They add a little entropy, but they cause real trouble: a $ or ! inside double quotes in a shell script is interpreted by bash, a # can start a comment in some config formats, and a backslash needs escaping in server.properties. When you turn symbols on, the generator only uses ! @ % ^ * - _ = + . ? ~, which leave out quotes, $, #, &, ;, |, spaces and the backslash, so the password still works in server.properties without escaping. In a shell, wrap it in single quotes.

"Exclude look-alikes" leaves out 0, O, 1, l and I. Turn it on if someone will read the password off a screen and type it into a phone app or a hosting panel. It costs a few bits, which a slightly longer password makes up for.

How to set up RCON

1. Stop the server
2. Open server.properties in the server's main folder
3. Find the existing enable-rcon, rcon.port and rcon.password lines and replace them with the three lines from the tool. Do not add a second copy of a key; with duplicate keys, only one of them is used
4. Save the file and start the server
5. Look for a line like RCON running on 0.0.0.0:25575 in the console or logs/latest.log. If you see a message about a missing RCON password instead, the password line did not save

Keep a copy of the password in your password manager or in the config of whatever tool connects. There is no way to read it back from the server except by opening server.properties.

Docker

The popular itzg/minecraft-server image sets these keys from environment variables: ENABLE_RCON and RCON_PASSWORD, with RCON_PORT for the port. Recent versions of the image generate a random password on their own if you leave RCON_PASSWORD unset, and the bundled rcon-cli reads it automatically. If you set the password yourself, use a value from this tool and keep it out of any compose file you publish.

Connecting to RCON

You need an RCON client. The server does not care which one; they all speak the same protocol.

• mcrcon, a small command line client: mcrcon -H 127.0.0.1 -P 25575 -p 'your-password' "list". Without a command it opens an interactive console
• rcon-cli: rcon-cli --host 127.0.0.1 --port 25575 --password 'your-password' list
• Libraries for Python, Node.js, Go and most other languages, for bots and dashboards
• Discord bots and web panels that run commands for you. These store the password, so only use ones you trust with full console access

Put the password in single quotes on the command line so the shell does not change it. Better still, read it from an environment variable or a file with restricted permissions, so it does not end up in your shell history.

What people use RCON for

• Backup scripts. Before copying the world, run save-off and save-all flush so the world files are not changing during the copy, then save-on afterwards
• Restart warnings. A cron job sends say Restarting in 5 minutes and then stop at the scheduled time
• Whitelist and ban management from a Discord bot or website. For the initial list, the whitelist.json generator builds the file directly
• Monitoring, by running list on a timer to count players

Commands run through RCON run as the console, with every permission. They do not need an operator, and they are not limited by op-permission-level. If you only want a staff member to have some commands, give them an operator level with the ops.json generator or a permissions plugin, not the RCON password.

Keeping RCON safe

RCON was designed in the early days of Source game servers and has not changed since. Two properties of the protocol decide how you should run it:

• Nothing is encrypted. The password and every command and response cross the network in plain text. Anyone who can watch the traffic between your client and the server can read the password
• There is no rate limit. As covered above, nothing stops an attacker from trying passwords one after another

So the safest setup keeps the RCON port off the public internet entirely:

• Block the port in your firewall. Allow the game port (25565) and deny 25575 from outside. On a Linux machine with ufw, sudo ufw deny 25575/tcp does this, and the firewall rules generator writes a full ufw or iptables setup that leaves RCON closed. Many hosts also have a firewall in their control panel
• Connect from the same machine. Scripts and bots that run on the server itself connect to 127.0.0.1 and never need the port open
• Use a tunnel from elsewhere. From your own computer, an SSH tunnel such as ssh -L 25575:127.0.0.1:25575 you@your-server forwards the port privately, and your RCON client connects to 127.0.0.1 on your side. A VPN such as WireGuard or Tailscale does the same for several people
• Rotate the password when a staff member leaves or a bot is replaced. Generate a new one here, update server.properties, restart, and update the clients

If you run a network, each backend server behind a Velocity or BungeeCord proxy has its own RCON with its own password and port. The proxies themselves have no built-in RCON. Give every backend a different password so one leaked config does not open all of them, and keep the backends' RCON ports closed like their game ports. The Velocity config builder covers the proxy side of such a network.

Common mistakes

RCON does not start

Check the startup log. The usual causes are an empty password, the port already being used by another server on the machine, or enable-rcon still set to false because the file has two enable-rcon lines. Hosting panels sometimes manage server.properties themselves and overwrite your edits on restart; in that case set RCON in the panel's settings.

"Authentication failed" in the client

The password in the client does not match the file exactly. Copy it again with the "Copy password" button, and check that the shell has not changed it: an unquoted or double-quoted password with $ or ! is the classic cause. If you edited the file while the server was running, the server is still using the old password until it restarts.

The client connects but times out

The port is blocked between the client and the server, which is what you want from outside. Connect from the server itself or through a tunnel. If you are already on the server, check that rcon.port in the file is the port you are connecting to.

Using the same password everywhere

A password that also opens your hosting panel, database or email turns one leak into many. RCON passwords are cheap: generate a separate one for each server.