Supported NamelessMC versions

One-click installer targets NamelessMC 2.2.5 on the DefaultRevamp template. Other 2.2.x versions / custom templates are flagged and patched by hand.

Modern two-factor authentication and passwordless passkeys for NamelessMC — by CruelWinter.

🔐 Give members real 2FA choice: authenticator app, email one-time codes, and passkeys (fingerprint, face, PIN, or security key). They can turn on as many as they like — any one signs them in.

Why you need it

Out of the box NamelessMC only offers authenticator-app 2FA, and its email 2FA was left unfinished (the code literally says // TODO). This module finishes email 2FA, adds phishing-resistant passkeys, and layers on recovery codes so nobody gets locked out — all from a clean manager in the User CP.

Features

• 🔑 Passkeys (WebAuthn) — true passwordless "Sign in with a passkey" (Face ID, Touch ID, Windows Hello, YubiKey, phone).
• ✉️ Email one-time codes — 6-digit codes with expiry + attempt limits.
• 📱 Authenticator app — the built-in TOTP method, kept and integrated.
• 🧯 One-time recovery codes — issued automatically, accepted at login as a fallback, regenerate anytime.
• ➕ Multiple methods at once — enable app + email + passkeys together; the login box accepts a code from any of them.
• 🔔 Security alert email whenever 2FA is enabled on an account.
• 🎚️ Per-method admin toggles — turn Email codes / Passkeys on or off site-wide.
• 🧩 One-click installer — no editing code by hand.

One-click install, safely

NamelessMC has no hook for adding a login method, so the module patches a few core files. You never touch code: enable the module, open StaffCP → 2FA, and click "Apply patches." Every file is backed up first, anything that doesn't match the stock version is safely skipped, and a one-click Revert restores the originals. Re-run it after a NamelessMC upgrade and you're done.

Requirements

• NamelessMC 2.2.x (auto-installer built for 2.2.5 + DefaultRevamp).
• HTTPS + OpenSSL — passkeys require a secure origin (works behind Cloudflare; the passkey domain is your site).
• Working outgoing email for the email-code method (recovery codes cover you if mail is down).

What's included

Drop-in modules/2fa/ module (bundles the MIT lbuchs/WebAuthn library — no Composer needed), the in-panel installer, and a README.

v1.0.0
  - Email one-time codes (completes NamelessMC's stubbed email 2FA)
  - Passkeys / WebAuthn: passwordless "Sign in with a passkey"
  - One-time recovery codes with regenerate + login fallback
  - Multiple methods enabled at once; login accepts any enabled method
  - "2FA enabled" security alert email
  - Per-method admin toggles (StaffCP)
  - One-click, backed-up core patcher + revert (StaffCP -> 2FA)
  - Dedicated Two-Factor manager in the User CP

Made by CruelWinter — cruelwinter.org. Version 1.0.0.