No passwords.
Just your client.
Anyone can look up a public profile. To change yours (equip cosmetics, listing, deleting your data) you sign in with a short code that you confirm inside MCC.
Find a player
Public profile, no login needed
Shows equipped cosmetics and, only if the player allows it, that they play MCC. Heads come from our own server, never from a third party.
Sign in
Confirmed in the client, verified through Mojang
Open MCC → Settings → Accounts → Pair website, check that the code and account match, and confirm.
------
Waiting for confirmation in the client …
Signed in as .
Safe by design.
Your password and your Microsoft tokens never leave the client. The website only ever sees a short code and, afterwards, a short-lived session cookie.
- The website asks our server for a one-time code (single use, valid about 5 minutes).
- In MCC you open Pair website, enter or confirm the code, and see which account it signs in, so a phished code would be obvious.
- The client proves it owns the account with Mojang's standard session check, the same one servers use. Our server verifies it with Mojang.
- The website receives a session cookie: HttpOnly, Secure, SameSite=Strict, short-lived. It's the only cookie we set.
Your data, your call.
When signed in you can switch the player listing on or off, change what you wear, sign out everywhere, and delete your account and all of its data at once. Until then, write to mail@0a0.dev. See the privacy policy.