Minecraft 'Cannot Verify Secure Profile' Fix

Minecraft "Cannot Verify Secure Profile" Fix

If players suddenly fail to join your Minecraft Java dedicated server with a "Cannot verify secure profile" message, the problem is usually not raw server performance. It is almost always an authentication or chat-signing mismatch involving enforce-secure-profile, a proxy, a Bedrock bridge, or a chat-modifying plugin.

Quick Triage

Symptom	Likely Cause	First Fix
Vanilla Java players cannot join after an update	Outdated proxy or plugin	Update Paper, Velocity/Bungee, ViaVersion, and auth plugins
Bedrock players fail but Java players work	Geyser/Floodgate path needs relaxed secure profile handling	Set enforce-secure-profile=false and retest
Players join but chat breaks or kicks them later	Chat-signing or chat-format plugin conflict	Disable chat modifiers and test clean

What the Server Actually Says (26.3)

"Cannot verify secure profile" is how people describe the problem, not a line the vanilla 26.3 server prints. The 26.3 server never refuses a join because a player has no profile key; a join refused for that reason comes from a proxy or plugin. What the server itself does:

• With enforce-secure-profile=true, chat from a player whose client sent no profile key is refused with a red message: "Chat disabled due to missing profile public key. Please try reconnecting." The server log records Failed to update secure chat state for NAME. Bedrock players joining through Geyser and Floodgate have no Java profile key, so they hit this.
• With enforce-secure-profile=true, the same player's commands that carry a chat message (/msg, /say, /me, /teammsg, or /kick and /ban with a reason) are refused with "The command had unexpected or missing command argument signatures." The log shows Received unsigned command packet from NAME, but the command requires signable arguments.
• With the setting on or off, a client whose chat acknowledgements do not add up (missed, reordered or inconsistent message counts, as some proxies and chat-rewriting plugins cause) is kicked with "Chat message validation failure", and the log shows Failed to validate message acknowledgements from NAME.
• With the setting on or off, a client that offers a profile key the server cannot validate is kicked with "Invalid signature for profile public key. Try restarting your game." A signed message from a key that has run out is refused with "Chat disabled due to expired profile public key. Please try reconnecting." The server judges expiry by its own clock, so check the time on both the server and the player's machine.

The setting only applies when online-mode=true: the server checks enforce-secure-profile and online-mode together, and a server in offline mode never enforces it. That includes a backend behind a proxy, which runs with online-mode=false. With enforcement off, unsigned chat is accepted and shows the tag "Unverified message. Cannot be reported."

Step 1: Check the Relevant Server Properties

The key settings live in server.properties. On most public Java servers you should leave online-mode=true. The setting that usually needs attention is enforce-secure-profile.

online-mode=true
enforce-secure-profile=false
prevent-proxy-connections=false

Use this as a troubleshooting baseline if you run any proxy or Bedrock bridge. If you operate a plain Java-only server with no special auth layer, you can often leave enforce-secure-profile=true.

Step 2: Isolate Proxies and Bridges

• Update Velocity, Waterfall, or Bungee before changing random Paper settings.
• Update Geyser and Floodgate if Bedrock players are affected (see Minecraft crossplay for how Bedrock joins interact with secure-profile enforcement).
• Temporarily test with players connecting straight to the backend if your setup allows it.
• Retest after disabling chat-format, anti-chat-report, or profile-mangling plugins.

Step 3: Keep Authentication Strict Where It Matters

Do not solve this by turning off account verification entirely. Keep online-mode=true unless you intentionally run an offline-mode network behind a trusted proxy. The safer fix is usually:

1. Leave Mojang account verification on.
2. Relax only enforce-secure-profile if your stack requires it.
3. Update proxy, bridge, and protocol plugins.
4. Retest with a clean plugin set before re-enabling extras.

Step 4: Verify Plugin Compatibility After 1.21.x Updates

This error often appears right after a Minecraft minor update because one layer is stale. Check these first:

• Paper or Purpur build version
• Velocity or Waterfall/Bungee build version
• ViaVersion / ViaBackwards
• Geyser / Floodgate
• Chat formatting, moderation, and profile plugins

When to Leave Secure Profile Enforcement On

Leave enforce-secure-profile=true if you run a plain Java-only server with no Geyser/Floodgate bridge, no unusual proxy chain, and no plugin that rewrites chat or player profile data. In that setup, turning it off is usually unnecessary.

Need a cleaner stack for modern Java, Paper, proxies, and Bedrock bridges? Launch a Minecraft server on Supercraft and test changes without rebuilding the whole network from scratch.