BPP | Bedrock Pack Protector for Geyser
A Geyser fork that auto-encrypts your resource packs and blocks pack-theft tools at the protocol layer.
A Geyser fork that auto-encrypts your resource packs and blocks pack-theft tools at the protocol layer.
References
Built on top of Geyser: https://github.com/GeyserMC/Geyser
Geyser is licensed under MIT. BPP retains all upstream Geyser copyright notices.
Purpose
The Bedrock protocol forces servers to disclose resource pack content keys to every connecting client. Common pack-theft tools exploit this by impersonating a player and capturing keys in under a second. Pack encryption alone does not stop this.
BPP raises the cost of pack extraction with multiple independent defense layers. It requires no work from the operator after install: drop a plain pack in a folder and BPP encrypts and sends it.
Features
- Multiple independent detection layers that fingerprint and block unauthorized pack downloaders before, during, and after the resource pack handshake
- Automatic encryption of every resource pack on startup using the standard Bedrock encryption format
- Stable per-pack content keys across restarts (clients only re-download when you actually change a pack)
- Persistent IP bans and Xbox account bans for detected sessions, enforced on subsequent reconnections
- Forensic event log recording every detection with full session context
- Ships as a drop-in replacement for upstream Geyser
Available builds
This product ships all four Geyser platform builds:
Geyser-Spigot.jar— Spigot, Paper, FoliaGeyser-BungeeCord.jar— BungeeCord and forksGeyser-Velocity.jar— VelocityGeyser-Standalone.jar— standalone proxy mode
Auto-encryption
- Drop unencrypted
.mcpackor.zipfiles into Geyser'spacks/source/folder - On startup, BPP encrypts each pack and emits the encrypted output for Geyser to serve
- Source files are never modified, keep them for editing
- Edit a source pack and restart to trigger automatic re-encryption
What BPP does not promise
The Bedrock protocol requires the server to disclose the content key in the resource pack handshake. No server-side defense can prevent a legitimate-looking client from receiving that key.
What BPP delivers within that constraint:
- Default-configuration unauthorized download tools are detected and refused before any key is sent
- Every extraction attempt costs the attacker a real Xbox account and IP, not just a quick reconnection
- All detections, attempts, and key issuances are logged for after-the-fact attribution
If absolute zero leaks are required, no software can deliver that on the stock Bedrock protocol. BPP delivers the strongest practical defense without rewriting Microsoft's client.
Installation
- Stop your server (or proxy)
- Replace your existing Geyser jar with the matching BPP build
- Start the server. BPP creates its data folder and a
packs/source/folder under Geyser's data directory - Drop your unencrypted
.mcpackfiles intopacks/source/ - Restart. BPP encrypts and serves them.
License system (DRM disclosure):
BPP includes an Ed25519-signed license file that auto-binds to the buyer's server fingerprint on first start. The license check runs entirely locally at startup; no network connection or external server is required for validation. The license file is bundled inside the jar at distribution time and a binding lock file is written to the server's data directory on first run. If the license fails to validate (corrupted, missing, or bound to a different server), Geyser will refuse to start and log the reason.
No data is transmitted off the buyer's server. No IP addresses, hardware identifiers, usage telemetry, or any other information is reported to the seller or any third party.
Licensing
- Updates included as upstream Geyser updates are integrated.
- Source code is not included.
- Redistribution, resale, or sharing of the jar is not permitted.
Support
Discord: discord.gg/bedrockpacks
Issues and feature suggestions go through Discord. Response within 24 hours on weekdays.
