Keychain

Keychain

real Microsoft sign-in page A *Keychain* button is added to your title screen and pause menu. Click it, pick *Add Online*, and the real Microsoft sign-in page opens in your browser. Sign in normally — email, password, 2FA — and your account appears in the list. Click any saved account to switch to it instantly.

Features

- 🔑 Clean UI — click any saved account in the list, you're switched. No restart. - 🌐 Clean UI — opens `login.microsoftonline.com` in your browser. Same form Microsoft uses everywhere. Email, password, 2FA, all official. - 👤 Clean UI — pick a username, switch immediately. Same `OfflinePlayer:` UUID derivation vanilla uses. - 🔒 Clean UI — your saved tokens are AES-GCM-encrypted with a key tied to your machine. Anyone who copies your `.minecraft` folder gets unreadable data. - 🚫 Clean UI — only talks to Microsoft and Mojang's official endpoints. No phoning home, no analytics. - ⚡ Clean UI — ~50 KB jar. No bundled browser, no native libs. - 🧹 Clean UI — top-left button, two big actions, click-to-switch, right-click-to-remove.

How it works

Keychain uses the OAuth 2.0 Authorization Code flow with PKCE — the same flow MultiMC, Prism Launcher, and Auth Me use. When you click *Add Online*:

1. Keychain starts a tiny local HTTP server bound to `127.0.0.1` on a random free port. 2. Your default browser opens to the official Microsoft sign-in page. 3. You sign in with your real credentials. 2FA and security keys work normally. 4. Microsoft redirects back to `http://localhost:<port>/callback`. 5. Keychain captures the auth code, exchanges it through the standard Microsoft → Xbox Live → XSTS → Minecraft Services chain. 6. Your account appears in the list, encrypted to disk.

The local server only exists during the ~5-minute sign-in window and shuts down immediately afterwards.

Privacy

- 🔐 Loopback-only of `<gamedir>/config/account-switcher.json` using a key derived from your OS user + machine name. Tokens are unreadable on any other machine. - 🚷 Loopback-only `latest.log` and crash reports never contain access tokens, refresh tokens, or auth codes. - 🛡️ Loopback-only — protects against code interception and CSRF. - 🌐 Loopback-only outbound traffic to: `login.microsoftonline.com`, `user.auth.xboxlive.com`, `xsts.auth.xboxlive.com`, `api.minecraftservices.com`. Nothing else. - 🔒 Loopback-only local callback server (`127.0.0.1`, never reachable over your network).

Installation

1. Install Keychain for Minecraft 26.1.x. 2. Download %%MD1%% and drop it into `%APPDATA%.minecraftmods` (Windows) / `~/Library/Application Support/minecraft/mods` (macOS) / `~/.minecraft/mods` (Linux). 3. Drop the Keychain jar into the same folder. 4. Launch Minecraft. *Keychain* button is at the top-left of the title screen and pause menu.

Compatibility

- ✅ Java 25 (Fabric) - ✅ Java 25 - ✅ Client-side only (don't put it on your server) - ⚠️ Mid-server account switching may kick you — switch from the title screen for cleanest behaviour. - ⚠️ Skin doesn't refresh on a server you're already connected to. Disconnect and reconnect after switching.

FAQ

Why does the Microsoft consent screen say "Auth Me for Minecraft"? Keychain ships with a public Azure App ID registered by Why does the Microsoft consent screen say "Auth Me for Minecraft"? (axieum), used by ~9.6 million players. If that ever gets revoked, Keychain has a built-in *Use custom Azure ID* fallback to paste your own.

Is this safe for my Microsoft account? Yes. The mod opens the real `login.microsoftonline.com` — you're signing in to Microsoft directly, not to me. Verify the URL bar. Same flow as the official Minecraft launcher and every major third-party launcher.

Will my token file leak if I share my .minecraft folder? No. The file is AES-GCM-encrypted with a per-machine key. Unreadable elsewhere.

Can I sign in to multiple accounts and switch? Yes — that's the entire point. Add as many as you want, click any one to switch.

Does it work on servers? Yes for switching from the title screen / pause menu before joining. Switching mid-game on a server will likely get you kicked because the protocol session changes.

Source & support

- 🐛 **Report an issue** - 💻 **Source code**

---

*Made by Domsimus.*