Is Crafty Controller Secure and Self-Hosted?

Updated

Yes. Crafty Controller is a free, open-source Minecraft server manager that runs entirely on your own machine. According to the project's site, it is 100% self-hosted, stores all data locally, uses Argon2 password hashing, and defaults to an SSL-secured web server. The source code is published under GPLv3, so anyone can inspect or modify it.

These claims describe the software's design. Your actual security still depends on how you deploy and expose it, so the sections below separate what Crafty provides from what you have to configure.

What "self-hosted" means here

Crafty runs as a web server on your own hardware. By default, the interface is reachable by devices on your local network. To allow access from outside that network, you forward a port on your router.

The practical consequence: server files, player data, backups, and account credentials live on your machine, not on a vendor's cloud. The site states there are no shared cloud instances and no SaaS company handling your data. That removes a third-party data holder from the picture, but it also means backups, uptime, and access control are your responsibility.

Security features the project documents

Feature What the site says What it means for you
Password hashing Industry-standard Argon2 Stored panel passwords are hashed rather than kept in plain text
Web server Defaults to an SSL-certificate-secured server Traffic to the panel can be encrypted, but you should confirm the certificate is valid and trusted on your setup
Hosting model 100% self-hosted, data stored locally No shared cloud instance or vendor access to your data
Source code GPLv3, publicly available on GitLab You or others can audit the code and verify behavior
Access scope Local network by default; port forwarding for external access External exposure is opt-in, and it widens your attack surface

Where the real risk sits

The documented defaults are a reasonable starting point, but most incidents in self-hosted panels come from deployment choices rather than the software itself. Before exposing Crafty beyond your LAN, check these:

  • Port forwarding: Only forward the panel port if you actually need remote access. If you do, restrict source addresses where possible and keep the SSL certificate current.
  • Account hygiene: Argon2 protects stored hashes, but weak or reused panel passwords still get guessed. Use a strong, unique password.
  • Network placement: Consider whether the panel should sit on the same network as other personal devices, or on a segmented one.
  • Backups: Since data is local, a disk failure or ransomware event affects your only copy. Keep off-machine backups.
  • Updates: The project says it is actively developed by Arcadia Technology with ongoing major improvements. Apply updates to pick up fixes.
  • Source review: GPLv3 guarantees the code is inspectable. If you run a public-facing instance, reviewing release notes and the GitLab repository is a low-cost check.

Who this fits

Crafty suits users who want full control of their Minecraft server data and are comfortable with a small amount of technical setup. The site describes it as requiring "only a bit of technical knowledge and a desire to learn," with Linux deployment scripts, Windows executables, and Docker installs available. It also offers free volunteer support in its Discord.

It is a weaker fit if you want a vendor to handle patching, certificates, and uptime for you. In that case, the self-hosted model shifts those jobs onto you rather than removing them.

Quick verification checklist

  1. Confirm the panel loads over HTTPS with a valid certificate.
  2. Check that the panel is not reachable from the internet unless you intentionally forwarded the port.
  3. Verify your panel password is strong and unique.
  4. Confirm backups exist somewhere other than the server's own disk.
  5. Check you are on a current release from the project's GitLab page.