Make your Valheim server privatePassword, permitted list and bans

Published on September 2, 2026 · last updated on October 21, 2026

The password is mandatory

Unlike in many games, the password in Valheim is not optional, but a requirement: a dedicated server only starts with one, and it has to be at least five characters long.

On top of that comes a rule that regularly causes confusion: the password must not appear in the server name. A server called "Midgard" with the password "midgard123" does not start. If you wonder why the server no longer comes up after renaming it, you have usually run into exactly this.

The password alone already protects your world: even if the server shows up in the list, nobody gets in without it.

The three lists

The server holds three text files, each with one ID per line:

• Admin list - who may use admin commands, see Admin commands.
• Permitted list. As soon as it contains entries, only those listed in it get in - this is the actual whitelist.
• Ban list - who is banned.

You edit the files via WebFTP in the browser or via SFTP. You will find the players' IDs in the server logs or via the player list in the game.

Using the permitted list correctly

The decisive point: as long as the list is empty, it has no effect - everyone with the password gets in. As soon as the first entry is in it, it becomes active and locks everyone else out.

That leads to the most common trap: if you do not add yourself, you lock yourself out of your own server with the first entry. So always enter your own ID first, then those of your friends.

For a fixed group, the permitted list is the clean tool - considerably more reliable than a password that ends up in a Discord screenshot at some point.

Visibility in the server list

Independently of password and lists, you decide whether your server is listed publicly. For a private group, there is a lot to be said for keeping it hidden: anyone who knows the server address or the join code still gets in.

A hidden server gets no join attempts from strangers - and therefore no discussions about why someone cannot get in.

Banning someone

The ban list is the permanent version of kicking someone out. An entry blocks the ID, regardless of whether the person knows the password and the address.

For a quick case, the kick command from the console is enough; for a permanent one, you add the ID to the ban list. Admin commands describes both in more detail. After changing the lists, a restart is the safe way to make sure they are read in.

Finding out IDs

For the permitted, admin and ban lists, you need the ID of the respective player - not their display name. There are two convenient ways to get it:

• From the server logs. When someone connects, the server logs their ID. Let the person join once and then look at the console in the web interface.
• Via the player list. As an admin, you see the connected players including their IDs in the game, see Admin commands.

Copy the ID instead of typing it - a wrong digit locks out the right person and lets the wrong one in. And put each ID on its own line; several entries on one line are not read.

Which setting for which group?

And as with every change to the server configuration: make a backup of the world files beforehand, see Create backups.

Frequently asked questions