ServerPasswordOnce

🛟 Need help or found a bug? Get support at support.doodesch.de/serverpasswordonce.

Server mod: a player who already entered the current server password is not asked for it again.

What it does

• A player who entered the current password once joins without the password window after that.
• When you change the server password, every player must enter it once more.
• The mod saves no password. For each player it saves the Steam id, a salted fingerprint of the password and the time of the last join.
• When you ban a player, the mod removes that player from the guest list.

Requirements

The mod works on Steam servers. On a server started with -crossplay it asks every player as usual, see "Crossplay servers" below.

Installation

1. Install BepInExPack_Valheim on the server.
2. Put ServerPasswordOnce.dll into BepInEx/plugins/ServerPasswordOnce/ on the server.
3. Start the server with -password as usual.

The server log then shows The server password is in force.

Admin command

Admins from adminlist.txt type the command in the game console. The game runs it on the server.

serverpasswordonce status            mod state, backend, number of guests, path of the guest list
serverpasswordonce list              all guests with their last join
serverpasswordonce forget <id|name>  remove one guest; they must enter the password again
serverpasswordonce forgetall         remove all guests
serverpasswordonce reload            read the guest list file again

status and list write to the server log, not to your game console. forget <name> works only while that player is online. For other players, use the id from list.

Guest list

serverpasswordonce.txt in the save folder of the server, next to adminlist.txt. One line per guest: Steam id, password fingerprint, last join.

To remove a guest by hand, delete the line and run serverpasswordonce reload.

Crossplay servers

On a server started with -crossplay, the game does not verify the player id. Anyone who knows the id of a guest could join without the password. For this reason the mod does not skip the password there and writes a warning to the server log.

Risk / AllowUntrustedBackends = true skips the password on crossplay servers too. While it is on, the server writes a warning on every start.

Configuration

BepInEx/config/DooDesch.ServerPasswordOnce.cfg on the server. Restart the server after a change.

Changelog

All notable changes to this project are documented here. The format follows Keep a Changelog; versions follow SemVer. The section for a version is written once, when the version is tagged; the release workflow publishes it unchanged to GitHub, Thunderstore and Nexus.

[Unreleased]

[1.1.0] - 2026-10-01

• The mod now works on servers started with -crossplay. You can keep -crossplay in the start command.
• On a crossplay server, serverpasswordonce list shows the platform id and the PlayFab player id of each guest. forget accepts each of them.
• After a change between a start with -crossplay and a start without it, every player enters the password once more.
• Guests that an older version saved on a crossplay server are removed at the first start, because their saved id was not safe.
• Risk / AllowUntrustedBackends has no effect on Steam servers and crossplay servers.

[1.0.1] - 2026-10-01

• The server log says at the start when the mod is not active, and why. On a crossplay server it names -crossplay as the argument to remove. Reported by lautasantenni.
• The server password is in force. is written only when the mod skips the password for known players.
• The install steps say that start_headless_server.bat contains -crossplay.

[1.0.0] - 2026-09-13

• Players who already gave the current server password join without the password window.
• Changing the server password asks everyone once more; the password itself is never stored.
• Admin command serverpasswordonce lists, forgets and reloads guests while the server runs.
• Optional: forget a guest after days away, and cap how many guests the server remembers.
• Steam servers by default; crossplay keeps asking unless an admin turns that on in the config.