Security
MinecraftAFK is designed to keep your account safe while it stays online. You sign in on Microsoft's website, so we never see your Microsoft password or two-factor authentication codes. We only receive the access needed to connect your Minecraft account to a server, and you can remove that access at any time. Your account connects to servers through a private proxy that is never shared with another customer.
Who operates MinecraftAFK?
We build and run MinecraftAFK at Valoks ApS, a Danish software company operating out of our offices at Cortex Park 26N, 5230 Odense M, Denmark. We founded Valoks in 2023 and changed its legal structure in 2026, continuing the business as Valoks ApS.
We are responsible for the service and how your personal data is handled. Our company registration, CVR 46577655, lets you verify who you are dealing with in Denmark's official company register. You can reach us directly with questions or complaints, including by post at our offices.
For support, email contact@valoks.com. For privacy requests or formal complaints, email legal@valoks.com.
Every hosted AFK service needs sign-in access to your Minecraft account. Before you hand that access to anyone, check who you are handing it to. Ask these four questions of any AFK service.
| What to check | Why it matters | MinecraftAFK |
|---|---|---|
| Can you find out which company runs it? | Whoever holds your sign-in access can join servers and chat as your account until you remove it. A service that gives you only a website and a username leaves you nobody to hold responsible if that access is misused. | Yes. Valoks ApS, CVR 46577655. Denmark's official company register lists who owns and manages the company. |
| Is it bound by a data-protection law? | Data-protection law gives you rights over what a service keeps about you, and a regulator that acts on complaints. It only protects you if you know where the operator is established. | Yes. Valoks ApS is established in the EU, so the GDPR applies to everything we process, wherever you live. You can complain to Datatilsynet, the Danish data protection authority, without contacting us first. |
| Is someone answerable when something goes wrong? | An operator nobody can identify can close the site and disappear. A registered company keeps a fixed address and stays legally responsible for what it did. | Yes. Write to legal@valoks.com or by post to Cortex Park 26N, 5230 Odense M, Denmark. As a registered company, we can be held to account under Danish and EU law, including in court. |
| Are there reviews it does not control? | A service's own site says what it wants you to read. Reviews on an independent platform, where the service cannot edit or delete them, show how it treats people. | Yes. Rated 4.8 out of 5 from 152 reviews on Trustpilot, as of 14 October 2026. |
Can you find out which company runs it?
Why it matters
Whoever holds your sign-in access can join servers and chat as your account until you remove it. A service that gives you only a website and a username leaves you nobody to hold responsible if that access is misused.
MinecraftAFK
Is it bound by a data-protection law?
Why it matters
Data-protection law gives you rights over what a service keeps about you, and a regulator that acts on complaints. It only protects you if you know where the operator is established.
MinecraftAFK
Is someone answerable when something goes wrong?
Why it matters
An operator nobody can identify can close the site and disappear. A registered company keeps a fixed address and stays legally responsible for what it did.
MinecraftAFK
Are there reviews it does not control?
Why it matters
A service's own site says what it wants you to read. Reviews on an independent platform, where the service cannot edit or delete them, show how it treats people.
MinecraftAFK
Overview
Your Microsoft password never reaches us
Adding an account opens Microsoft's own sign-in page. Your password, 2FA codes and recovery details are entered there and stay between you and Microsoft. We never see, store or process them.
We can connect as your Minecraft account
We store the sign-in access and chat keys needed to keep your account online. Someone who got this information could join servers and send chat as your account until you removed access. They could not access your email, password, payments, or other Microsoft account information.
Account access stays on our servers
The sign-in tokens are never sent to your browser. This prevents a browser extension or another person using the same computer from reading them from the dashboard.
Card details never touch our servers
Stripe handles card and wallet payments, CoinGate handles crypto. We never receive a card number, so there is nothing of that kind in our systems to leak.
You can remove our access at any time
Removing the account in the dashboard immediately stops us from using that Minecraft account. You can also remove MinecraftAFK from your Microsoft account security settings, but due to limitations in how Microsoft revokes access, it can take up to 24 hours before the access is gone.
We do not store your chat
The chat window streams messages to your browser without writing a transcript to our database.
A private proxy carries the connection
Your account connects through an internet address rented for you alone from a proxy company and never shared with another customer. That company can see which Minecraft server the account joins and the Minecraft username used for the connection.
Running since 2022, no known breach
MinecraftAFK has operated since 2022 with no known breach and no known incident in which account tokens were exposed. Affected users will be notified if personal data is exposed.
Data we process
This is the information MinecraftAFK needs to work, why we need it, and what could happen if someone gained access to it. Information handled by another company is marked clearly.
| What we store | Why we need it | What could happen if someone got it |
|---|---|---|
| Microsoft and Minecraft sign-in tokens | Required to sign the account in and keep it connected to a Minecraft server. | Someone who got this information could connect to servers and send chat as your account until you removed access. They could not change your Microsoft password, read your email, or make purchases. We encrypt this information before storing it. |
| Email address | Billing, security notices, and account recovery. | Someone could send you convincing fake emails that look like security or support messages from MinecraftAFK. |
| Discord ID or Google account ID | Identifies you if you sign in with one of those providers. | It identifies your Discord or Google account. It grants no access to either: we hold an identifier, not a way in. |
| Password, if you set one | An optional sign-in method alongside Google and Discord. | We do not store the readable password. We store a one-way scrambled version used to check it when you sign in. A weak or reused password may still be guessed if that stored version is exposed. |
| Server address, port and version | Needed to connect using the correct Minecraft version. | It could reveal which Minecraft servers you connect to. |
| Chat from servers you connect to | We do not store it. | MinecraftAFK does not retain chat transcripts. Chat is streamed to the dashboard and held in the browser for the active session. We also do not store what the account saw, its position, or its inventory. |
| Your own IP address, if you verify in game | Connecting your own Minecraft client to our address proves that an in-game player is you. The address you connect from is part of what keeps that session yours. | An IP address can identify your network and approximate location. The dashboard masks it until selected. Unapproved requests are deleted within minutes of expiry, completed sessions about an hour after they end, and sessions you end manually are deleted immediately. Web request logs are retained for 30 days. |
| Your name and billing address | Charging the right tax, and issuing the invoice we are required to issue. | It could reveal your name and postal address. Invoice records are retained for five years as required by bookkeeping law and cannot be deleted on request during that period. |
| Proxy details you supply | Only if you choose to route an account through a proxy of your own. | Someone could use a proxy that you pay for. We only store this information if you choose to add your own proxy. |
| Card and crypto payment details | We do not have them. | MinecraftAFK does not receive card numbers or the private details used to make cryptocurrency payments. For a saved card, the payment company supplies the card type and last four digits for display in the dashboard. |
Microsoft and Minecraft sign-in tokens
Why we need it
Required to sign the account in and keep it connected to a Minecraft server.
What could happen if someone got it
Someone who got this information could connect to servers and send chat as your account until you removed access. They could not change your Microsoft password, read your email, or make purchases. We encrypt this information before storing it.
Email address
Why we need it
Billing, security notices, and account recovery.
What could happen if someone got it
Someone could send you convincing fake emails that look like security or support messages from MinecraftAFK.
Discord ID or Google account ID
Why we need it
Identifies you if you sign in with one of those providers.
What could happen if someone got it
It identifies your Discord or Google account. It grants no access to either: we hold an identifier, not a way in.
Password, if you set one
Why we need it
An optional sign-in method alongside Google and Discord.
What could happen if someone got it
We do not store the readable password. We store a one-way scrambled version used to check it when you sign in. A weak or reused password may still be guessed if that stored version is exposed.
Server address, port and version
Why we need it
Needed to connect using the correct Minecraft version.
What could happen if someone got it
It could reveal which Minecraft servers you connect to.
Chat from servers you connect to
Why we need it
We do not store it.
What could happen if someone got it
MinecraftAFK does not retain chat transcripts. Chat is streamed to the dashboard and held in the browser for the active session. We also do not store what the account saw, its position, or its inventory.
Your own IP address, if you verify in game
Why we need it
Connecting your own Minecraft client to our address proves that an in-game player is you. The address you connect from is part of what keeps that session yours.
What could happen if someone got it
An IP address can identify your network and approximate location. The dashboard masks it until selected. Unapproved requests are deleted within minutes of expiry, completed sessions about an hour after they end, and sessions you end manually are deleted immediately. Web request logs are retained for 30 days.
Your name and billing address
Why we need it
Charging the right tax, and issuing the invoice we are required to issue.
What could happen if someone got it
It could reveal your name and postal address. Invoice records are retained for five years as required by bookkeeping law and cannot be deleted on request during that period.
Proxy details you supply
Why we need it
Only if you choose to route an account through a proxy of your own.
What could happen if someone got it
Someone could use a proxy that you pay for. We only store this information if you choose to add your own proxy.
Card and crypto payment details
Why we need it
We do not have them.
What could happen if someone got it
MinecraftAFK does not receive card numbers or the private details used to make cryptocurrency payments. For a saved card, the payment company supplies the card type and last four digits for display in the dashboard.
The full legal version is in our privacy policy.
Risk considerations
Account security is only one part of using an AFK client. The rules and automatic checks used by the Minecraft server you join also matter.
- 1
Server rules may prohibit AFK clients
Some servers prohibit unattended gameplay, while others allow or encourage it. Review the rules of each server before connecting. MinecraftAFK cannot appeal enforcement actions taken by another server.
What we know about server rules - 2
AFK-only activity may be flagged
Servers may take action against accounts used exclusively for AFK activity, even when AFK connections are generally permitted. Anti-AFK movement keeps a session active but does not guarantee that it will be treated as normal play.
Can I get banned for only AFKing? - 3
A proxy company carries your Minecraft connection
Each account connects through an internet address rented from a proxy company. That company can see the server address, Minecraft username and, on newer versions, the account ID. Most Minecraft servers encrypt the rest of the connection. Offline-mode servers do not, so the proxy company may also be able to see chat sent through those servers. It cannot see your MinecraftAFK email address, home IP address, payment information, or MinecraftAFK account.
- 4
Someone could steal account access in a breach
We encrypt sign-in tokens, keep them on our servers, and never send them to the browser. If they were stolen, someone could join Minecraft servers as your account until you removed MinecraftAFK from your Microsoft account, and for up to 24 hours after that. We do not store card numbers or chat history, so those would not be included.
- 5
Anti-cheat systems may flag the connection
MinecraftAFK connects in the same way as a normal Minecraft client, and everything it sends is something a player's own game could send. A server may still notice that the account is automated or flag unusual activity.
How our client stays vanilla-accurate - 6
MinecraftAFK needs permission to use the account
Any online AFK service must be able to connect as the Minecraft account you add. MinecraftAFK asks only for the access needed to run the service, and you can remove that access at any time.
- 7
Services you add can see what you send them
A custom proxy can see traffic sent through it. Anyone you share an account with can use it. A Discord webhook can post chat lines, nearby player names, or images where everyone in that Discord channel can see them. Only connect services and people you trust.
Security controls
Microsoft sign-in, never your password
Accounts are added on Microsoft's official login.live.com page. We ask to sign in to Xbox Live as the account and keep it connected. We do not ask for access to mail, contacts, or files, and we never receive your Microsoft password.
Encrypted while sent and stored
Connections use HTTPS, and account tokens are encrypted before they are stored instead of being saved as readable text.
Sign-in tokens stay on our servers
The browser receives only the cookie that keeps you signed in to the dashboard. It never receives the Microsoft or Minecraft tokens, so a browser extension cannot read them from the page.
Sign-in you control
Log in with a password, Google or Discord, and link more than one so losing access to a provider does not lock you out. The dashboard will not let you remove your last remaining login method.
Removing access stops the account
When Microsoft removes our access, the account stops connecting until you sign in again. When you remove the last Minecraft account connected through a Microsoft login, we also delete the stored sign-in token.
Breach notification
Our privacy policy requires us to notify affected users promptly if their personal data is exposed.
Private proxies
Every MinecraftAFK plan includes a private proxy: the IP address your accounts connect to Minecraft servers from, rented for you alone and never shared with another customer. It has unlimited bandwidth, carries both Java and Bedrock connections, and bypasses all VPN blocks on all servers.
Check these four things before you trust any AFK service's proxies. A shared proxy can get your accounts banned for something someone else did, and a capped one takes them offline when its data runs out.
| What to check | Why it matters | MinecraftAFK |
|---|---|---|
| Is the proxy shared with other customers? | On a shared proxy, other customers' accounts connect from the same IP address. If one of them breaks a server's rules, an IP ban locks your accounts out too, ban plugins that match accounts by IP can flag yours as their alts, and their accounts count toward the server's per-IP account limit. | Never shared. Your proxy is rented for you alone, so the only accounts a server sees on its IP address are yours. |
| Is the bandwidth limited? | An account that stays online around the clock receives chunks, entities and chat the whole time. On a proxy with a data cap, your accounts go offline once it runs out. | Unlimited bandwidth, with no data cap and no charge for usage. |
| Does it work for Bedrock? | Bedrock connects over UDP. HTTP proxies cannot carry UDP and most SOCKS5 proxies have it switched off, so most proxies only work for Java. | Yes. Our proxies carry UDP, so Java, Bedrock and cracked accounts all connect through the same one, with nothing to set up. |
| Does it get past VPN blocks? | Many popular servers turn away IP addresses they recognise as a VPN or proxy, with a message or by silently disconnecting the account. | Yes, our proxies bypass all VPN blocks on all servers. If you are being blocked, contact us and we will find a bypassing proxy for your server. |
Is the proxy shared with other customers?
Why it matters
On a shared proxy, other customers' accounts connect from the same IP address. If one of them breaks a server's rules, an IP ban locks your accounts out too, ban plugins that match accounts by IP can flag yours as their alts, and their accounts count toward the server's per-IP account limit.
MinecraftAFK
Is the bandwidth limited?
Why it matters
An account that stays online around the clock receives chunks, entities and chat the whole time. On a proxy with a data cap, your accounts go offline once it runs out.
MinecraftAFK
Does it work for Bedrock?
Why it matters
Bedrock connects over UDP. HTTP proxies cannot carry UDP and most SOCKS5 proxies have it switched off, so most proxies only work for Java.
MinecraftAFK
Does it get past VPN blocks?
Why it matters
Many popular servers turn away IP addresses they recognise as a VPN or proxy, with a message or by silently disconnecting the account.
MinecraftAFK
Tier 2 and Tier 3 can add more private proxies to give accounts their own IP addresses. Servers known to block VPNs are listed in our VPN blocks guide.
Vanilla protocol accuracy
Anti-cheat plugins judge an account by the packets its client sends: what they contain, the order they arrive in, and how fast they come. A client that sends something the real game never would is the easiest automated account for a server to spot. How accurately an AFK client speaks the Minecraft protocol is a question of account safety, not only of staying connected.
MinecraftAFK's Java client is our own implementation of the Minecraft protocol, written to send what the vanilla game sends, in the order it sends it. It is not built on a general-purpose bot library. Check these four things before you trust any AFK client with your account.
| What to check | Why it matters | MinecraftAFK |
|---|---|---|
| Do servers reject the packets it sends? | Servers check every packet against the game's rules. Block and item actions carry sequence numbers, inventory clicks carry state IDs, and malformed packets are refused. Kicks such as "invalid sequence" or "invalid packet" come from a client sending something the vanilla game never does, which is why the vanilla game never gets them. A client that needs fixes for particular servers to avoid these kicks is showing the problem, not solving it: the vanilla game connects to every server the same way. | No. In the 30 days to 13 October 2026, across thousands of Minecraft accounts, no server failed to read a packet sent by a MinecraftAFK account, and none kicked one for invalid sequence. |
| Does it stay under servers' packet limits? | Many servers cap how many packets a connection may send each second and kick anything above it with "You are sending too many packets". A client that sends in bursts trips these limits even when it is doing nothing wrong, and repeated kicks make an account stand out. | Our client paces what it sends to stay under common limits. In the week to 13 October 2026, protocol-level kicks of every kind, packet limits and errors inside a server's own network included, came to fewer than one per 1,000 hours online. |
| Does it only do what a player can? | Anti-cheat plugins look for movement, reach and actions no real player could produce, and act against the account that sends them. | Yes. Everything MinecraftAFK sends is something a player's own game could send: walking, looking, chatting, using items and opening menus. |
| Does the service know when and why its accounts are kicked? | Every client is kicked sometimes. What matters is whether the people running it see a new kind of kick before their users do. | Yes. Every disconnect is classified by cause and counted across all our accounts. That is where the figures on this page come from. |
Do servers reject the packets it sends?
Why it matters
Servers check every packet against the game's rules. Block and item actions carry sequence numbers, inventory clicks carry state IDs, and malformed packets are refused. Kicks such as "invalid sequence" or "invalid packet" come from a client sending something the vanilla game never does, which is why the vanilla game never gets them. A client that needs fixes for particular servers to avoid these kicks is showing the problem, not solving it: the vanilla game connects to every server the same way.
MinecraftAFK
Does it stay under servers' packet limits?
Why it matters
Many servers cap how many packets a connection may send each second and kick anything above it with "You are sending too many packets". A client that sends in bursts trips these limits even when it is doing nothing wrong, and repeated kicks make an account stand out.
MinecraftAFK
Does it only do what a player can?
Why it matters
Anti-cheat plugins look for movement, reach and actions no real player could produce, and act against the account that sends them.
MinecraftAFK
Does the service know when and why its accounts are kicked?
Why it matters
Every client is kicked sometimes. What matters is whether the people running it see a new kind of kick before their users do.
MinecraftAFK
Figures come from our own monitoring of every MinecraftAFK Java Edition account connected to a server, counted in hours online. A server's own rules still apply, however accurate the client is: see the risk considerations above.
Hosted and self-hosted operation
Running an AFK client on your own computer keeps the account access on that computer. Using MinecraftAFK lets the account stay online without leaving your computer running or connecting from your home internet. Both options have advantages and things you need to look after.
Self-hosting on a Pi or spare PC
Where it wins
- Your account access stays on your own computer
- You are not relying on an online AFK provider
- No subscription, and the hardware is yours
- Full control over the client code you run
What it costs you
- You must keep the computer, operating system, and AFK client secure and updated
- The Minecraft server sees your home internet address, which may be limited or blocked
- An old or untrusted AFK client could contain security problems or harmful code
- The account is offline whenever the machine, the power or your internet is
- Electricity, hardware wear, and your time maintaining it
MinecraftAFK web client
Where it wins
- Stays online through power cuts, reboots and holidays
- Nothing to patch, install or expose on your home network
- Servers see your private proxy, not your home internet address
- Password never involved, and access is revocable in one click from Microsoft
- Tokens encrypted at rest and never exposed to the browser
- Managed from any device, including a phone
What it costs you
- MinecraftAFK holds the sign-in access needed to run the account
- It is a subscription
- If sign-in tokens were stolen, someone could join servers as your account until you removed access
For users who do not want a hosted service to receive a token, our free local client runs on a Windows machine under their control. The token does not leave that machine and is not received by MinecraftAFK.
Fraud and impersonation
Treat any request that conflicts with the following statements as an attempted impersonation or phishing attack.
- We will never ask for your Minecraft or Microsoft password. Not in support, not in Discord, not ever.
- We will never message you first on Discord asking for account details, a login code, or a token.
- We will never ask you to install software to "verify" or "recover" your account. The only download we offer is the local client from our own /local page.
- We will never ask you to log in through a link someone sent you. Type the address yourself, or use the dashboard you are already signed into.
- We will never send you an in-game verification request you did not start. If one appears and you did not ask for it, refuse it: approving hands that person your server profiles and the Minecraft accounts on them.
- We will never sell, rent or share your data with advertisers.
Reporting a vulnerability
If you have found a security issue in MinecraftAFK, email contact@valoks.com with "Security" in the subject line. Include what you found, the steps to reproduce it, and the impact as you see it. We aim to acknowledge reports within three business days.
We will not pursue legal action against anyone who reports a genuine issue in good faith, who stays within their own account and their own data, who does not degrade the service for other users, and who gives us a reasonable window to fix the problem before publishing. Bug bounties may be issued at our discretion based on the severity and quality of the report, but payment is not guaranteed. We will credit you if you want the credit.
Track record
MinecraftAFK began with our free local client in 2022, followed by the web client in 2023. Since the local client's launch, we have served 45,000+ users. In that time we have had no known breach of our systems and no known incident in which account tokens were exposed. If personal data is exposed, we will notify affected users in accordance with our privacy policy and applicable law. Our team also participates in responsible disclosure outside MinecraftAFK, reporting security issues to other services and helping their teams resolve them before they can affect users.
Live uptime is published on our status page, and reviews we do not control are on Trustpilot, where we are rated 4.8 out of 5 from 152 reviews as of 14 October 2026. Technical questions are welcome in our Discord.
Want to AFK 24/7 Without Leaving Your PC On?
