Keychain

Switch Minecraft accounts in-game without restarting. A Keychain button is added to your title screen and pause menu. Click it, pick Add Online, and the real Microsoft sign-in page opens in your browser. Sign in normally — email, password, 2FA — and your account appears in the list. Click any saved account to switch to it instantly.

Features

• 🔑 One-click account switching — click any saved account in the list, you're switched. No restart.
• 🌐 Real Microsoft login — opens login.microsoftonline.com in your browser. Same form Microsoft uses everywhere. Email, password, 2FA, all official.
• 👤 Offline accounts — pick a username, switch immediately. Same OfflinePlayer: UUID derivation vanilla uses.
• 🔒 Encrypted at rest — your saved tokens are AES-GCM-encrypted with a key tied to your machine. Anyone who copies your .minecraft folder gets unreadable data.
• 🚫 Zero telemetry — only talks to Microsoft and Mojang's official endpoints. No phoning home, no analytics.
• ⚡ Tiny — ~50 KB jar. No bundled browser, no native libs.
• 🧹 Clean UI — top-left button, two big actions, click-to-switch, right-click-to-remove.

How it works

Keychain uses the OAuth 2.0 Authorization Code flow with PKCE — the same flow MultiMC, Prism Launcher, and Auth Me use. When you click Add Online:

1. Keychain starts a tiny local HTTP server bound to 127.0.0.1 on a random free port.
2. Your default browser opens to the official Microsoft sign-in page.
3. You sign in with your real credentials. 2FA and security keys work normally.
4. Microsoft redirects back to http://localhost:<port>/callback.
5. Keychain captures the auth code, exchanges it through the standard Microsoft → Xbox Live → XSTS → Minecraft Services chain.
6. Your account appears in the list, encrypted to disk.

The local server only exists during the ~5-minute sign-in window and shuts down immediately afterwards.

Privacy

• 🔐 AES-GCM encryption of <gamedir>/config/account-switcher.json using a key derived from your OS user + machine name. Tokens are unreadable on any other machine.
• 🚷 No tokens in logs. latest.log and crash reports never contain access tokens, refresh tokens, or auth codes.
• 🛡️ PKCE + state parameter — protects against code interception and CSRF.
• 🌐 HTTPS-only outbound traffic to: login.microsoftonline.com, user.auth.xboxlive.com, xsts.auth.xboxlive.com, api.minecraftservices.com. Nothing else.
• 🔒 Loopback-only local callback server (127.0.0.1, never reachable over your network).

Installation

1. Install Fabric Loader for Minecraft 26.1.x.
2. Download Fabric API and drop it into %APPDATA%\.minecraft\mods (Windows) / ~/Library/Application Support/minecraft/mods (macOS) / ~/.minecraft/mods (Linux).
3. Drop the Keychain jar into the same folder.
4. Launch Minecraft. Keychain button is at the top-left of the title screen and pause menu.

Compatibility

• ✅ Minecraft 26.1, 26.1.1, 26.1.2 (Fabric)
• ✅ Java 25
• ✅ Client-side only (don't put it on your server)
• ⚠️ Mid-server account switching may kick you — switch from the title screen for cleanest behaviour.
• ⚠️ Skin doesn't refresh on a server you're already connected to. Disconnect and reconnect after switching.

FAQ

Why does the Microsoft consent screen say "Auth Me for Minecraft"?
Keychain ships with a public Azure App ID registered by Auth Me (axieum), used by ~9.6 million players. If that ever gets revoked, Keychain has a built-in Use custom Azure ID fallback to paste your own.

Is this safe for my Microsoft account?
Yes. The mod opens the real login.microsoftonline.com — you're signing in to Microsoft directly, not to me. Verify the URL bar. Same flow as the official Minecraft launcher and every major third-party launcher.

Will my token file leak if I share my .minecraft folder?
No. The file is AES-GCM-encrypted with a per-machine key. Unreadable elsewhere.

Can I sign in to multiple accounts and switch?
Yes — that's the entire point. Add as many as you want, click any one to switch.

Does it work on servers?
Yes for switching from the title screen / pause menu before joining. Switching mid-game on a server will likely get you kicked because the protocol session changes.

Source & support

• 🐛 Report an issue
• 💻 Source code

Made by Domsimus.