I saw a plugin pack, it sells for 200 TL, a friend of mine already bought it — what harm is there in him passing it to me? — a sentence you hear constantly in the Discords of the Minecraft server scene. Or, more bluntly: I bought BuildBattle, my brother wants it too, surely it stretches to the two of us? Or further still: This plugin author has died, there is no support any more, is using a crack really a sin? Questions like these are in fact matters that have to be examined on several layers at once: legal, ethical and technical. This guide looks at where copying a plugin pack stands under Turkish law, what the Minecraft EULA says, where reverse engineering sits, and why using a cracked plugin is not only a legal problem but an ethical one.

What Does the Minecraft EULA Say?

Mojang's Minecraft EULA (End User License Agreement) is binding on players and server owners alike. It sets out clear principles around developing and using plugins:

  • Plugins fall into Mojang's Mods and Plugins category
  • Using and developing a plugin is free, provided the plugin is not restricted by its own paid licence
  • Charging a specific fee for a plugin falls under the Commercial Use section of the EULA
  • On servers that sell things in-game, pay-to-win mechanics are prohibited
  • A plugin author may attach a licence to their own plugin and require you to accept it

In other words, Mojang does not interfere with the plugin ecosystem — but you are still bound by whatever licence the plugin author has attached.

Types of Plugin Licence

Plugins are distributed under a range of licences. Each grants different rights of use:

1. Free, Open Source (MIT, Apache 2.0, GPL)

This is the most permissive category. You can download the plugin, use it, modify it, even use it commercially. GPL adds the condition that if you modify it, your modification must be open source too.

  • Examples: LuckPerms (MIT), EssentialsX (GPL), WorldEdit (LGPL), Vault (LGPL)
  • Rights: unrestricted use
  • Restriction: under GPL, keeping the derivative work open source

2. Free, Closed Source (Spigot Free)

Plugins distributed free on Spigot but with the source code closed. Using them is fine, but modifying them or reverse engineering them is prohibited.

  • Examples: a great many free Spigot plugins
  • Rights: use, including use on a commercial server
  • Restrictions: reverse engineering, redistribution

3. Paid (Premium)

Plugins sold for money on places like Spigot, BuiltByBit and Polymart. Buying one grants you a licence to use the product, but no right to distribute it.

  • Examples: Matrix AC, EssentialsX Premium, BentoBox premium modules
  • Rights: use on a single server (sometimes on more than one)
  • Restrictions: cracking, leaking, sharing, reselling

4. Custom / Proprietary

A plugin a developer wrote to order. Depending on the contract, the owner is either the customer or the developer.

Scenario 1: Can I Use the Pack My Friend Bought?

Ahmet bought a plugin pack for 300 TL. He shares it with you, and you want to use it on your own server.

Is it legal? No. It goes against the pack's licence agreement. Most plugin pack licences state that the pack may be used on a single server or may not be used on another server without the seller's approval. When Ahmet hands it to you he is both breaching his own licence and putting you in the position of an unlicensed user.

Is it ethical? No. For the person who put the pack together, that money is what their labour is worth. If you are running two servers, paying for two licences is the fair thing. The they will never know anyway attitude is what, in the long run, finishes off quality plugin sellers in the Turkish market.

Is there a penalty? Under FSEK, software copyright infringement can also carry a custodial sentence (up to 2 years). In practice a Turkish plugin seller is not going to sue you over your Minecraft server, but technically it is possible.

Scenario 2: Using a Cracked Plugin

A plugin that sells for 30 euros on Polymart, downloaded free from Discord under a Crack or Nulled tag, and used.

The legal side: using a crack of commercial software is an infringement of FSEK. There is a risk of imprisonment and a fine, though in practice it is hard to pursue.

The technical risk: this part is even bigger than the legal risk. Cracked plugins almost always carry a backdoor. The attacker adds a piece of code to your plugin, and that code:

  • Sends your server's IP and port to their own servers
  • Ships admin account details out
  • Leaks your MySQL credentials
  • Grants itself OP when it wants to and wipes the server
  • Reserves resources on players' machines to run a crypto miner
  • Hunts for Discord tokens and Steam session cookies

The security hole affects not only your server but your players' data. Under KVKK, if there is a personal data breach it is your responsibility — you are the one held liable when player data you were processing alongside a cracked plugin is exfiltrated.

Scenario 3: I Bought Someone Else's Pack — Can I Pull the Plugins Out and Sell Them Myself?

Taking plugins out of pack A, putting them into pack B, and selling B.

Is it legal? Absolutely not. This infringes the copyright of both the seller of A and the plugin authors. An FSEK infringement and unfair competition — both at once.

The practical consequences: you get labelled a thief in the Turkish plugin community. Two years later nobody will buy a plugin from you, partner with you, or even join your server. The community is small; your name gets around.

Scenario 4: Writing My Own Plugin Through Reverse Engineering

Studying a plugin's output, decompiling it, reading its code, and writing a similar plugin.

The legal position: complicated. Article 38 of FSEK sets out a narrow exception for reverse engineering for interoperability. So examining a plugin in order to integrate it with another system may be lawful. But copying its code, or imitating the same functionality line for line, is not.

The software engineering principle: the clean room approach. One developer uses the plugin and writes up its specification. A different developer writes the code from scratch against that specification. A clean room implementation is lawful. In practice, when one person says I reverse engineered it and wrote my own, there is no clean room — which means there is legal risk.

Scenario 5: I Bought a Pack, It Was Badly Broken, I Fixed It Myself — Now I Want to Sell It On

Redistributing the version you fixed is not your right to exercise; the fixes sit on top of the original seller's work, and all you have made is a derivative work. To distribute a derivative work you need the permission of the original owner.

With an open source (GPL) plugin this is not a problem; sharing your changes is in fact required. But with premium packs it is strictly prohibited.

Scenario 6: The Licence Has Expired but the Plugin Still Does the Job

Some premium plugins are sold on an annual licence model. When your licence runs out the plugin may keep working (the old version), but you no longer receive updates. Forcing the licence to extend itself (cracking it) is not lawful. You have to renew the licence or move to an alternative plugin.

The Penalties Applied Under Turkish Law

Article 71 of FSEK provides the following penalties for software copyright infringement:

  • Judicial fine: from 1 to 5 years depending on the scale of the infringement
  • Imprisonment: from 3 months to 2 years where it is commercial in scale (offering it for sale)
  • Damages: payable to the rights holder, up to 3 times the loss
  • Seizure of the work: an order to destroy every published copy

How Do Google, Mojang and Governments See Your Plugin Pack?

  • Google: blocks crack plugin sites and penalises them in SEO
  • Mojang: can exercise its right to remove you from the server list (rarely applied)
  • The Turkish Telecommunications Authority: can block access to software piracy sites
  • SPK and BTK (the Turkish capital markets and telecoms regulators): additional oversight for server owners operating as legal entities

The Ethical Side: The Ecology of the Turkish Plugin Market

The Minecraft plugin market in Turkey is small. There are 10-20 serious Turkish sellers and developers. Their annual revenue is about one fifth of what their European counterparts make. How widespread cracking is strips being a Turkish developer of its economic meaning.

For an ecosystem to be healthy: the developer has to be paid for their work. The customer has to pay honestly. The seller has to provide support. If that cycle turns, in five years Turkey will be producing packs at international standards too. If cracking is everywhere, the seller cannot earn from sales and stops offering support, the customer gets burned, and everybody loses.

KEYDAL's Approach

KEYDAL operates as a company registered in Turkey, and the licence terms of all our products are set out in writing. In our packs:

  • Only plugins we wrote ourselves are included (custom-built)
  • We comply with the licence agreements of any third-party plugins we use
  • Every pack is sold with a licence agreement
  • We neither use nor sell cracked or leaked plugins
  • We issue invoices and process data in line with KVKK
  • Even where a pack's source code is not open, its contents are listed transparently

The Technical Risks of Cracked Plugins in Depth

Examples of malicious code embedded in cracked plugins — real cases:

Case 1: IP Collection

In 2023, the modified versions of 30+ premium plugins distributed on a popular crack plugin site were sending the server IP, the player IPs and the online player list to a remote API every 30 seconds. Hundreds of thousands of servers were affected. The aim of the person behind the crack was to DDoS those servers later and sell them protection.

Case 2: Crypto Miner

A cracked anti-cheat plugin was quietly handing 20% of the server's CPU to Monero mining. Server owners spent weeks asking why is the TPS so low?; in the end a security researcher found it.

Case 3: A Backdoor Command

In a leaked shop plugin, a private /bkdr command had been added by its developer. Anyone who typed that command received instant OP on the server. It turned out the plugin was in use on hundreds of servers.

Case 4: A Discord Token Thief

A cracked version of DiscordSRV was sending the Discord bot token entered in the config to its own server. Whoever ran that server took over the bot's Discord account.

How Do You Tell Whether You Are Running a Crack?

Some plugins arrive as cracks inside a pack you got from another server; you may be running them without knowing. Check for these signs:

  • Open plugin.yml inside the plugin jar; is the author field empty?
  • Is there a digital signature in the jar? (a *.SF file inside META-INF/)
  • Does the plugin print This plugin is licensed to X in the log? A cracked version hides that message.
  • Does the plugin make requests to an external server when it checks for updates? You can watch the network activity
  • Does the plugin's sha256 hash match the hash the developer published?
bash
# Checking a plugin hash on Linux
sha256sum plugins/SuspiciousPlugin.jar
# Compare it against the hash the developer published

Frequently Asked Questions

Can I modify an open source plugin and sell it?

It depends on the licence. Under MIT/Apache, yes; you can sell your modification (leaving the copyright notice in place). Under GPL you can sell the modification, but you have to make the source code available to the customer. LGPL is more flexible.

Is it legal to decompile a plugin and learn from its code?

Decompiling a plugin and studying it for your own education is a grey area. Decompiling for commercial competition, and copying the code, is unlawful. The clean-room approach is the safest.

What do I do if the plugin author has died or disappeared?

In that situation the copyright in the plugin passes to their heirs. You can carry on using it (your licence continues), but there may be nobody left to grant permission for a derivative work. In cases like this, weighing up an alternative plugin is the most practical answer.

I installed a cracked plugin — how do I clean up now?

For a clean start: (1) shut the server down, (2) delete the whole plugins/ folder, (3) re-download every plugin from its original source, (4) redo the configs BY HAND (an automated replace leaves the backdoor in place), (5) DROP TABLE for clean tables in the database, (6) tell your players to change their passwords.

What test can I run to be sure I am dealing with someone using legal plugins?

Ask the seller supplying the pack for the licence details of every plugin (Spigot link, invoice). On Spigot it is possible to see the Owned marker on premium plugins. If there is a licence/about message written by the developer inside a plugin, run it. Do not settle for trust me, it is licensed — ask for a written agreement.

Learning Resources: Building Your Own Software

Writing your own plugins instead of using cracked ones is the most sustainable route in the long run. Resources to get started:

  • SpigotMC forum tutorials: the basics of Java + the Bukkit API
  • The Paper documentation: docs.papermc.io — the official API guide
  • Kody Simpson on YouTube: a Bukkit plugin development tutorial series
  • The Udemy Minecraft Plugin course: paid, but structured
  • Fatih Katı's Turkish Minecraft plugin lessons: Turkish-language content on YouTube

Learning to write plugins takes somewhere between 3 and 6 months, but being able to build solutions for your own specific needs is priceless.

Verifying a Plugin Licence

Ways to check the licences of the paid plugins inside a pack you bought:

  • The Spigot resource: if the plugin's resource page says Only users who have purchased this resource may post in this thread, it is a paid one
  • The about command: some plugins show licence details through a /pluginname about command
  • plugin.yml: the author and description fields may carry licence information
  • The about section of the config: a licence comment in the plugin's first few lines
  • A licence file: is there a plugins/PluginName/LICENSE.txt file?

What Do the KEYDAL Plugin Alternatives Give You?

As an alternative to cracked plugins, KEYDAL provides free plugin alternatives at no cost:

  • Open source: the code is on GitHub, anyone can audit it
  • MIT/Apache licence: free to use on commercial servers
  • Turkish documentation: the installation and configuration guides are in Turkish
  • Support: community support over Discord
  • Up to date: quick adaptation to new Minecraft versions
  • Compatibility: Paper/Spigot/Folia support

Running a Plugin Security Audit

Extra steps to make sure the plugins in your pack are safe:

1. Inspecting the Jar

bash
# List the files inside the jar
unzip -l plugins/SuspiciousPlugin.jar

# Is it obfuscated? Are the class names readable?
unzip -l plugins/SuspiciousPlugin.jar | grep class

# Check plugin.yml — are author, website and description correct?
unzip -p plugins/SuspiciousPlugin.jar plugin.yml

2. Watching the Network Requests

bash
# Watch every outbound connection on the server
sudo tcpdump -i any -n 'tcp and not port 25565 and not port 22 and not port 3306'

# When the server starts or a player connects, requests should only go to Mojang, PaperMC and known services

3. File System Changes

bash
# Is it creating files outside the server directory?
sudo auditd -w /etc/passwd -p wa
sudo auditd -w /etc/shadow -p wa
sudo auditd -w /root/.ssh -p wa

# Does the plugin try to get root access? You will see it in the log

Assessing How Trustworthy a Plugin Author Is

  • The GitHub/GitLab profile: is the source open? Years of activity?
  • The Spigot premium badge: is the seller verified?
  • The age of the Discord server: is it a community more than a year old?
  • The number and quality of reviews: 100+ reviews, and mostly positive?
  • Code style: is it using the modern Java API, or stuck on old practices?
  • Support responses: are the replies on Discord/the forum professional?

A List of Ethical Plugin Authors

Developers you can trust when you work within the plugin ecosystem. These are authors who care about their plugins, maintain them actively and offer support:

  • The EssentialsX team: open source, active for 10+ years
  • LuckPerms (lucko): MIT licence, live support
  • Aikar (Paper team lead): the Paper performance revolution
  • The SpongePowered team: ecosystem builders
  • The GriefDefender team: the modern branch of GriefPrevention
  • The Citizens team: the standard for NPC systems
  • The BentoBox team: the SkyBlock platform

One last note: the Minecraft community is small. Word travels fast about whether a server behaves honestly. Those who go the lawful route end up with a bigger and more loyal community in the long run. Rather than looking for cheap answers in the short term, invest in the health of the ecosystem.