Make your Terraria server privatePassword, ban list - and why there is no whitelist

Published on August 9, 2026 · last updated on November 3, 2026

Set a server password

The most effective and simplest protection. The value goes into the serverconfig.txt:

password=yourPassword

Terraria then asks for it when joining. Important for the process: the game asks for address, port and password one after the other in separate fields - so the password is not appended to the address. The way in detail is described in join a server.

• Only change the file while the server is stopped - otherwise it overwrites it on shutdown.
• For a quick change while running, there is the console command password. It only applies to the current session, though, see server commands.
• An empty password= means: open to everyone who has the address.

Changing and sharing the password

A server password is not an account password - it is shared, and shared secrets go stale. There are two ways to change it, with different reach:

1. Permanently: stop the server, change password= in the serverconfig.txt, start the server. Only this way does the change survive the next restart.
2. Immediately: the console command password while running. It takes effect from the next join attempt, but does not survive a restart - afterwards, the value from the file applies again.

In practice, you use both one after the other: first the console command so the change takes effect immediately, and at the next scheduled restart, update the file. Anyone who only issues the command later wonders why the old password suddenly works again.

One point that is easily overlooked: the password is stored in plain text in the configuration file. Anyone you give WebFTP or SFTP access can read it - file access is always also access to the server's credentials. So be sparing with file access rather than with the game password. And keep the password separate from everything else: it ends up in chat histories and on sticky notes, so it should not be valid anywhere else.

Why there is no whitelist

The Vanilla Terraria server has no whitelist. There is no entry in the serverconfig.txt and no console command for it - a name list like in Minecraft does not exist here.

What does exist is the opposite direction: a ban list. In the serverconfig.txt, the banlist entry points it to a file, banlist.txt by default, and it is filled via the console command ban.

This leads to the practical division:

For a fixed group of friends, the password is entirely sufficient. It has only one known weakness: whoever has it passes it on - and you do not notice.

With TShock: a real whitelist and accounts

As soon as you need more than a shared password, the way leads via TShock. It replaces the Vanilla server and brings exactly the missing building blocks:

• Whitelist - a real access list instead of a shared password.
• User accounts - everyone logs in with their own account instead of connecting anonymously.
• Groups and permissions - moderators do not have to be allowed to do everything.
• Traceability - you can see who did what.

The price: TShock is a different server type. It is compatible with the normal Terraria client - your players notice nothing - but it cannot be combined with tModLoader. If you want to run mods, you cannot use TShock and stay with the password.

What the password does not cover

The password answers exactly one question: who gets in. It does not control what happens inside - and in Vanilla, nothing does. Whoever has joined may do everything: build, dig, empty chests, summon bosses. Among friends, that is not a problem, and it becomes one the moment someone passes on the password.

• No undo. Demolished builds and emptied chests can only be brought back by a backup of your own. Backups are self-service via WebFTP and SFTP - the process is described in create backups.
• No proof. Vanilla does not log who changed what. That only becomes traceable via TShock accounts - before that, there is only suspicion.
• No protection against cheated-in items. That is what secure=1 in the serverconfig.txt is for, Terraria's own anti-cheat. It does not replace moderation, but it costs nothing.

If you have put a lot of time into a world, you should therefore do two things in parallel: keep access via the password narrow and back up the world file regularly. On a modded server, this is mandatory anyway, because there a changed mod selection alone changes the world - see tModLoader & Calamity.

What suits which group

• Fixed group of friends, Vanilla: set a password, share the address made up of IP and port - done.
• Fixed group, modded: a password as well. With tModLoader, there is no alternative, and the required mod installation is a natural hurdle anyway.
• Community with changing members: TShock with whitelist and accounts.
• Open server: no password, but work consistently with the ban list - and plan TShock for regions and grief protection.

A practical note at the end: really remove the password after a test phase if the server is to become public. A forgotten entry is a common reason why nobody can get onto a freshly started server.

Frequently asked questions