UntraceableSeed

Knowing a world's seed no longer rebuilds it. For a new world, UntraceableSeed makes world generation read the stored seed mixed with a 32-byte secret that exists in one place only: a file in the world's own save folder. The seed that /seed shows and level.dat keeps stays an ordinary Minecraft seed, but on its own it reproduces nothing. Bedrock and deepslate are placed from a further, separate part of the same secret. Forge, Minecraft 1.20.1, no other mod needed.

Important before you install

• Only new worlds. The mod acts on a world created while it is installed. A world that already exists is never changed, and a world made before the mod was installed generates exactly as vanilla does — but the server says so at every start and tells every administrator who joins, and /untraceableseed newworld confirm keeps that world under another name and sets up a protected one.
• On a host that creates the world when it installs the server (BisectHosting does: it starts the server once before you upload any mod), that first world has no secret. After adding the mod, use /untraceableseed newworld confirm from the console, or delete the world folder entirely, to get a protected world.
• Whenever the main world is missing, the server asks again. Deleting the world folder (or renaming it) gives the same setup as a new server.
• It removes one leak, not every leak. The stored seed stops being enough to rebuild the world. Somebody who can read the server's files can still read the secret, and somebody who studies enough of the world from the inside can still, in principle, work out the value generation really uses. Read "What it does NOT protect against" below before relying on it.
• The secret file is part of the world. untraceableseed-secret.bin and untraceableseed-world.properties sit next to level.dat and must go wherever the world goes: every backup, copy and move. A world that loses its secret file generates its next chunks from the stored seed alone, with a visible seam against the terrain already there.
• Do not remove the mod from a world with mixed generation. Without the mod nothing reads the secret, and new chunks generate the plain way: the same seam.
• Seed maps and seed finders stop working for that world, for you too. Given the stored seed of a mixed world they show a different world. That is the purpose of the mod.
• A hosted or nogui server with no world yet does not create its world on the first start. It starts an empty, temporary void world and waits for an administrator who has the mod in their own game. Until the setup is confirmed, everybody else who joins is disconnected with a message that says why: a player is asked to come back later, an administrator without the mod is told to install it.
• Same build on both sides when both have it. A game with the mod and a server with the mod must carry the same build. A game without the mod joins a server with it, and a game with it joins any server.

Requirements

• Minecraft and Forge: Minecraft 1.20.1 with Forge 47 (47.x).
• Loader: Forge only.
• Other mods: none. It does not need Server Logistics or any library mod.
• Licence: MIT. Author: puercoalopecico.

What each side does, with and without the mod

The mod is optional on either side. Everything about the seed, the secret and generation runs on the logical server only: the dedicated server, or the integrated server behind a singleplayer world. A game client never computes any of it.

The mod has one network channel, untraceableseed:setup, version 2. It carries only the remote setup screen. A game and a server that both have the mod must have the same channel version, which in practice means the same build of the mod; a side without the mod is always accepted. That includes a plain vanilla game or server, without Forge, on every version: this follows from how Forge's network code treats such a peer, and has not been tried with a real vanilla game or server.

Why the seed matters on a server

On an ordinary server the seed is the world. Every part of world generation reads that one 64-bit number directly: terrain noise, biome placement, structures, decoration, caves, bedrock. Whoever learns it can generate the same world on their own computer and then:

• find strongholds, ancient cities, bastions and every other structure without exploring,
• find diamonds and other ores without mining for them,
• compare their copy with the server and see where players have built or dug.

The seed can get out in many ways: an operator runs /seed, level.dat leaks, or somebody recovers it by observing the world. The game's own "random" seed is also weaker than it looks: it comes from a 48-bit generator started from the clock, so only one seed in 65,536 can ever come out of it, and its state can be guessed from the time the world was made.

What UntraceableSeed does

For a new world that the mod creates, four things happen:

1. The stored seed. The number kept in level.dat and answered by /seed is a full 64-bit value made from the operating system's cryptographic randomness and, if you want, your mouse movements. The game's 48-bit generator is never used. You may also type the seed yourself.
2. The world's own secret. 32 bytes, made from the same pool of randomness under a separate label, so that neither the seed nor the secret tells anything about the other. It is written once to untraceableseed-secret.bin in the world's folder, next to level.dat. It is never written to level.dat, never answered by a command, never sent to any game and never shown on any screen.
3. Generation itself, in every dimension. Terrain, biomes, aquifers, ore veins, surface rules, structure placement, decoration (trees, plants, ores placed as features), caves and ravines, trail ruins, slime chunks, biome borders, the End gateways, /place — in the Overworld, the Nether, the End and other mods' dimensions — read the stored seed mixed with the secret (the stored seed combined by XOR with a 64-bit value derived from the secret), not the stored seed alone. So does the generation of the mods checked one by one (see "Compatibility"). The same mixed value is used everywhere for the same world, so the world is as consistent as if it had simply been created with that value as its seed.
4. Bedrock and deepslate. With hideBedrockPattern on (the default), the bedrock floor, the bedrock roof and the deepslate transition are placed from a further, separate part of the secret, kept apart even from the mixed generation seed. Reading the bedrock pattern is the fastest way to narrow down an unknown seed by digging, and it is the first thing seed-cracking tools try; with this step it says nothing about the value the rest of generation uses.

Plus /seed, which answers only at or above a permission level you choose (4 by default).

The world still looks like Minecraft. The generator, its rules, the density functions and the kinds of terrain, biomes and structures do not change. Only the number fed into them does.

Things that are not generation but must agree with it also read the mixed value: the structure lookup behind /locate structure, explorer maps, dolphins and eyes of ender, ocean monuments rebuilt when their chunk is loaded again, and the End pillars rebuilt when the dragon is summoned again. They therefore describe the world that really exists.

Only a closed list of code gets the mixed value. Minecraft's own generation and the generation and structure finders of the mods checked one by one; everything else — the hash every game receives, /seed, and any mod that sends or shows the seed — keeps getting the stored seed. Some mods do send it to players (Supplementaries' globe, for one): given the mixed value they would hand out exactly what this mod keeps.

What it does NOT protect against

This is the part to read slowly.

• Anyone who can read the server's files can read the secret. The secret is the 32 bytes of untraceableseed-secret.bin in the world folder, and that file together with the stored seed reproduces the generation. The host's staff, anyone with the panel's file manager, FTP or a backup, and whoever the owner hands those to, can read it. Between the last "Confirm" of a remote setup and the next start, a copy also waits in untraceableseed-remote-secret.bin in the server's root folder. The file is not encrypted: a key to decrypt it would have to sit in the same files.
• A mod running inside the server is as trusted as file access. The game's own generator holds the mixed seed in memory, as it must, and a server-side mod can read anything the server can.
• An administrator without file access cannot learn the secret, but does get the stored seed. Operator level 4 gives /seed and nothing more. No command, console line, log line, screen or packet carries the secret.
• The value generation really uses can still, in principle, be found from the world itself. Structures, biomes and terrain (and bedrock too, if hideBedrockPattern is off) are computed from the mixed generation seed. A tool that observes enough of them, or a player who notes several structures and runs a seed finder, targets that value exactly as it would target a vanilla seed. No mod can make generation immune to that without changing what generation produces. What nobody can do any more is start from the stored seed and get anywhere.
• The stored seed itself can still be learnt by a player. The stored seed alone reproduces nothing in a mixed world:
  • Every game receives, when it joins or changes dimension, a SHA-256 hash of the stored seed (vanilla sends it for biome colour blending). It is enough to confirm a guess. It is left so on purpose: a hash of the mixed seed would help somebody confirm a guess of the value that matters.
  • Some mods send the stored seed, or something worked out from it, to players (Supplementaries' globe, YUNG's Better Desert Temples, Eidolon…). With them, /seed's permission level keeps nothing from players.
• In a world made now, slime chunks follow the mixed seed. A player who maps enough of them can study that value, as structures already allow.
• Mods nobody has checked. A mod that generates by reading the seed on its own gets the stored seed until it is added to the list: consistent, but that part of the world is reproducible from the stored seed. The server's log names such a mod once.
• A world made with an earlier build of this mod keeps generating exactly as it was made: there, slime chunks, the End gateways, classic caves and the biome regions of TerraBlender and the mods built on it still follow the stored seed. Changing that in an existing world would cut its terrain at the border between old and new chunks.
• Some worlds generate exactly as vanilla does, so anyone with their seed can rebuild them: a world made before the mod was installed; a world for which "Normal" generation was chosen; and a world a server created with neither a window nor a remote setup (see the table under "Dedicated server").
• The date, the time and the key stretching add no randomness. They mix more into each new seed and secret and make every guess of the pool cost 100,000 hash rounds. Everything unguessable about a seed or a secret is still the operating system's cryptographic randomness and the mouse.
• On a server with no window, the mouse can only come from an administrator with the mod in their game. The console can finish a setup too, but only with a typed or system-random seed and normal generation: exactly what writing level-seed by hand already allowed.
• Several administrators setting a server up are trusted alike. Any of them can choose, go back or confirm, and whoever confirms first decides.
• The temporary void world of a remote setup can be seen for a moment by anyone who joins. A player who is not an administrator is a spectator there for about half a second before being disconnected (five seconds at the very most). That world holds nothing.
• It is not an anti-X-ray. It does nothing about what players can see in the chunks the server sends them.
• --universe and --world values with spaces cannot be read reliably from the command line; the mod then uses level-name to decide whether the world already exists.

The two choices, and every combination

The stored seed and the generation secret are two independent choices, made one after the other on the same wizard wherever the mod offers it: singleplayer's screen, the dedicated server's own window, and the administrator's screen of a remote setup.

The seed (step "Seed", heading "The world's seed"):

The generation (step "Generation", heading "Terrain generation"):

Every combination is available:

A secret is only ever made by "Mixed, with the mouse". There is no mixed generation without mouse movements.

The wizard

All three surfaces show the same wizard: a step indicator at the top, the step's explanation, one card per option, the mouse box or the seed field under the cards, and the "Back" and "Confirm" buttons.

• Nothing moves on until "Confirm" is pressed, and "Confirm" stays disabled until an option is chosen and, for a mouse option, its bar is full. Enter works as "Confirm".
• "Back" returns to the step before, and what was chosen there is kept and can be changed. Confirming the seed step again after going back draws a new seed.
• The mouse box shows a fading trail and a progress bar with the count ("512 of 1032 movements"). Only movements inside the box while a mouse option is chosen count towards the bar, but every movement goes into the pool. When the bar is full the wizard says "Enough gathered: press Confirm (moving on still adds more)".
• The seed and the secret are drawn at the moment their step is confirmed, not when the bar fills, so whatever moved in between is in them too.
• One press of "Confirm" counts once. Enter counts again only after the key has been let go, so a key held down does not confirm several steps. A second click within 350 milliseconds of the one before, with nothing else done in between, is the same click. Enter that is still down when the screen opens must be let go first. A double click slower than 350 milliseconds is two clicks.
• A finished wizard does nothing more whatever arrives: one world, one seed, one secret.

How a seed and a secret are made

The pool. A SHA-256 state that starts from 32 bytes of the operating system's cryptographic randomness (Java's SecureRandom). Every sample is hashed into it: a mouse position together with the nanosecond clock (System.nanoTime()) at that instant. The state depends on every sample ever added and nothing can be worked back from it. Even with no mouse movement at all the pool is already beyond guessing; the mouse adds randomness that not even the machine had.

What "Confirm" adds. Every new stored seed and every new secret, on every surface, is produced in three steps:

1. The moment of the press is hashed into the pool: the wall clock (milliseconds since 1970 and the nanoseconds of the second), the local date and time with its time zone and the day of the year, the nanosecond counter, and a few cheap facts of the machine that differ from one run to the next (free and total memory, the thread, the identity numbers of two objects made at that instant, how long the mod has been loaded, the process number).
2. The output is derived by key stretching with a label of its own: PBKDF2-HMAC-SHA256 (RFC 8018), 100,000 rounds, keyed with the pool's state and salted with the label of what is being derived (one label for the stored seed, another for the generation secret) and a draw counter. The stored seed is the first 8 bytes of the result; the secret is all 32.
3. The pool moves on under a third label, so nothing derived afterwards can be related to what was just derived.

What this is, honestly. It is more mixing, and it makes trying out guesses of the pool 100,000 times slower. It is not more randomness: somebody who knows roughly when a world was made can guess most of the moment, and stretching adds none at all. The pool was already out of reach before the first mouse movement (2 to the power of 256 possibilities). What is gained is that two derivations can never start from the same input, that a guess of the pool would also have to guess the instant, and that each guess costs 100,000 hash rounds. The separate labels are what keep the seed and the secret unrelated: knowing one says nothing about the other.

The derivation runs right where "Confirm" is handled and takes some tens of milliseconds on an ordinary machine; there is no waiting state.

Worlds already created are not changed by any of this. It only governs how a new seed and a new secret are produced. How a secret is stored, read back and used never changes for an existing world.

Singleplayer

With singleplayerMouse on (the default), pressing the button that creates the world on the "Create New World" screen opens the wizard first.

• The game's seed field is empty: both steps are asked, the seed and then the generation.
• You typed a seed into the game's own field: it is kept exactly as typed, and only the generation step is shown. You can still choose "Mixed, with the mouse" for your own seed.
• "Back" on the first step, or Escape at any time, returns to the create-world screen with nothing created.
• The last "Confirm" writes the seed into the game's field (when the wizard decided it) and creates the world.

The secret stays with that create-world screen until the world's folder is actually made, and is handed over for that folder alone. Leaving the screen, or a creation that fails or is cancelled, forgets it; a later world, and above all an existing one, can never receive it.

In singleplayer the secret is made on your own machine and written to your own disk. The owner of a singleplayer world can always use /seed in it, when they type it themselves; guests of a world opened to LAN are limited like players on a server, and receive nothing of the secret.

Dedicated server

Forge loads mods before the game reads server.properties. At that moment the mod reads the file itself, the same way the game does, and decides:

The server's own window

The window is titled "UntraceableSeed — new world" and is drawn in the language of the machine it runs on. It is the same wizard: step 1 the seed (random with the mouse, manual, or random with no mouse), step 2 the generation (mixed with the mouse, or normal). Each step needs "Confirm" (Enter works too). "Back" returns from the generation step to the seed step, and on the seed step undoes the chosen option.

If nobody uses the window at all for serverMouseTimeoutSeconds (120 by default), it finishes by itself: the system's randomness for a seed not confirmed yet, and normal generation for a generation not confirmed yet. Every click, key or mouse movement starts the count again, so it never cuts anybody off in the middle of a choice. A server that restarts unattended never hangs. The window shows the notice "Finishes by itself after 120 s without use".

The console says that a seed was prepared and from how many mouse movements, and whether generation was mixed. It never prints the seed or the secret.

Remote setup: hosted servers and nogui

A rented server (Aternos, BisectHosting, Apex and similar) has no window anybody can reach, and neither does a server started with nogui. With remoteSetup on (the default), the mod does not pick anything by itself there.

What the server does on the first start

1. It rewrites level-type and generator-settings in server.properties to vanilla's flat preset with no layers and the biome minecraft:the_void, and keeps the real values in untraceableseed-remote-setup.properties in the server's root folder. No chunk of that world has anything to compute, so the server starts normally and at once.
2. As long as that file exists, a remote setup is pending. It is checked first on every start, so a server restarted in the middle of a setup goes on waiting (the choices themselves are made again from the first step).
3. The console says that a temporary world has started and which permission level an administrator needs.

Who may be there while it waits

Everyone who joins is made a spectator at once (the void has no floor, so nobody falls). Then:

Both disconnect messages are written by the server itself in the language of that player's game, so a game without the mod shows readable text. The server waits for the game to report its language before disconnecting: at least half a second and at most five seconds. On 1.20.1 the language arrives a moment after the player joins. A game set to US English is handled as fast as any other: the server recognises the arrival of its options by the skin parts the same packet carries (only an English game with every skin layer switched off still waits the five seconds). The console logs who was disconnected, why, and in which language.

The administrator's screen

The screen shows the server's own wizard over the void, with three steps: "Seed", "Generation" and "Summary".

• The wizard lives on the server. The screen only shows its latest state (sent five times a second while a bar fills, and at once after any choice) and sends back what is done on it.
• What the game sends: the mouse movements made inside the box (a position and the game's nanosecond clock for each; once a tick, at most 64 per packet, at most 1500 a second per administrator, more are dropped) and the presses, with a seed typed by hand when "Manual" is used.
• What stays on the server: the movements are mixed into the server's own pool, which started from the server's own cryptographic randomness. The seed and the secret are drawn there and never travel over the network. A randomly drawn seed is not sent to the administrator's game either.
• Escape closes the screen without losing anything. A clickable chat line ("screen closed. Click here or type /untraceableseed to open it again") or the command /untraceableseed opens it again.
• The summary ("Ready to create the world") lists what was chosen, for example "Seed: random, from the mouse" and "Generation: mixed with a secret from the mouse"; a seed typed by hand is shown as typed. Its button, "Confirm and stop", is the only press that cannot be undone. "Back" still works from there.

Several administrators at once: one setup, one winner

Several administrators with the mod may be connected at the same time. There is one wizard, on the server, and every screen shows it. Everything anybody does is applied on the server's own thread, one action after the other, each as one indivisible step. Every state of the setup carries a stamp (a number of the session, new at every server start, and a version that goes up with every change of step or of option, never with a mouse movement or a typed letter). Each screen sends the stamp it was showing with whatever is pressed, and the server applies a press only if that stamp is still the current one.

A refused press is answered with the setup as it stands now, and that screen shows "Not applied: it had changed" between its two buttons for four seconds. When the last "Confirm" is taken, every administrator's screen closes. The order of two presses made at the same instant is whichever reaches the server first; what the mod guarantees is that the result is always one whole action after another, never a mixture, and never two confirmations.

Finishing from the console

The server console (a host's console, RCON) can also finish the setup, but never with mouse randomness, and by itself never with mixed generation: only what writing level-seed by hand would already allow.

/untraceableseed status
/untraceableseed seed {seed}
/untraceableseed system-seed
/untraceableseed generation skip
/untraceableseed confirm

With a level-seed in server.properties the seed is already fixed: seed and system-seed are refused, and generation skip then confirm finish it. seed {seed} takes a number or any text, as the game's seed field reads it; system-seed takes a seed from the system's randomness; generation skip chooses normal generation; confirm writes everything and stops the server; status says which step the setup is on and what has been chosen. Each command is one indivisible step of the same setup the screens show (seed goes back to the seed step, sets it and confirms it in one), and every open screen is brought up to date at once. generation skip needs the seed first, and confirm needs the summary step to have been reached, from the console or from an administrator's screen. Players cannot use these forms: they are told to choose on the screen.

The last "Confirm"

1. The real level-type and generator-settings are written back to server.properties. The chosen seed is not written there: it waits in untraceableseed-remote-seed.properties in the server's root folder, so that a world deleted later is asked for again.
2. The server stops. It is announced in the console in the machine's language and to each connected player in theirs. The server does not start itself again: a host's panel or a restart script does, or whoever runs it starts it by hand.
3. The temporary world's files are still open at that point, so the server only leaves a small cleanup marker (untraceableseed-remote-cleanup.properties) and, if generation is mixed, the secret in untraceableseed-remote-secret.bin, both in the server's root folder.
4. On the next start the leftover void world's folder is deleted — only if it carries the temporary world's own mark, never the game folder itself; anything else is renamed — the real world is created with the confirmed seed, the secret is written into the new world's folder, and only then are the side files deleted. If the world cannot take the secret because it already has chunks, the side file is kept and the log says so.

If the settings could not be written (a full disk, for example), the setup stays confirmed by whoever confirmed it, and /untraceableseed confirm from the console writes the very same settings again; nothing new is drawn. Once everything is confirmed, seed, system-seed and generation skip are refused.

Turning remoteSetup off gives a windowless server the direct fallback instead: a system-random seed, normal generation, no temporary world and no waiting.

A world that exists without a secret

A world that was created without the mod (by a hosting's first start, for example) is never changed, but it is not protected either:

• At every start the console says so, and every administrator who joins is told once, in their language, with a clickable command.
• /untraceableseed newworld explains what happens; /untraceableseed newworld confirm stops the server, and on the next start the world folder is renamed to {name}-sin-secreto-{date} (nothing is deleted) and the server asks for the randomness as a new one would. A world that already has a secret needs /untraceableseed newworld force confirm.
• /untraceableseed keepworld keeps the world as it is and ends the warning.

Deleting only the Nether or the End of a world with a secret regenerates them with that same secret.

Existing worlds, the secret file and backups

The mod never changes how an existing world generates. When the server (or the integrated server) is about to start a world:

• a secret was just made for a brand new world: it is written to the world folder and used;
• no secret is waiting, but the world folder already has one: it is read back exactly and used;
• neither: no secret at all, and generation runs exactly as vanilla does for that world, forever. This covers a world with an explicit seed and a world from before the mod was installed. The mod does not add mixing to a world it did not create, because that would leave a seam between the chunks already generated and the new ones.

Guards that keep it so:

• A waiting secret is never written over an existing secret file and never applied to a world that already has saved chunks (any region file). The log says it was not applied.
• An existing secret file is read back even with enabled = false. That setting only stops the mod from making new things.
• The bedrock and deepslate choice is recorded with the world when its secret is made, in untraceableseed-world.properties next to the secret. Changing hideBedrockPattern or decorrelatedRandoms later only affects worlds made afterwards.

Backups. Keep untraceableseed-secret.bin and untraceableseed-world.properties with the world. A backup that contains the whole world folder contains them. If the secret file is lost while level.dat survives, the next start finds no secret and the world generates its new chunks from the stored seed alone, unmixed. Nothing is corrupted and nothing crashes, but there is a seam between the terrain already generated and what is generated afterwards, and the lost secret cannot be made again. Remember also that a backup of the world folder is a copy of the secret: whoever holds the backup can reproduce the generation.

/seed

• Below seedCommandLevel (4 by default) the answer is "The seed of this world is secret. Only administrators of level 4 can see it.", written by the server in the player's language.
• At or above that level, the vanilla answer: the stored seed, copyable, exactly as level.dat holds it.
• Vanilla's own requirement still decides who can use /seed at all: level 2 on a dedicated server, everybody in a singleplayer world or a world opened to LAN.
• The owner of a singleplayer world is never refused when they type the command themselves. Guests of a world opened to LAN are.
• The server console is always allowed.

Because the stored seed alone no longer reproduces a mixed world, an administrator who shares it hands over nothing that matters without the secret file too.

Who can know the generation secret

An administrator cannot learn it: not by a command, not from the console, not from a log, not from the setup screen, not from the network. Only somebody who can read the server's own files can.

Commands

"Console only" means the server console or RCON. A player who types one of those forms, whatever their level, is told "Administrators in the game choose on UntraceableSeed's screen; these commands are for the server console."

Settings

File: config/untraceableseed-common.toml. It is read by the dedicated server and, in singleplayer, by the game.

A config file written by an earlier build keeps the numbers it holds: Forge never overwrites a value that is already in the file.

Compatibility

• Tested on a server (1.20.1, Forge 47.4.28) with the author's own modpack (Twilight Forest, TerraBlender, Oh The Biomes We've Gone, Ice and Fire, When Dungeons Arise and more) and with Biomes O' Plenty, Regions Unexplored, Terralith, William Wythers' Overhauled Overworld, the Aether, the Undergarden, Ad Astra, L_Ender's Cataclysm, Incendium, Nullscape, Amplified Nether, Blueprint, Atmospheric and the Bumblezone: every dimension generates, differs with another secret and agrees with itself.
• Mods that read the seed on their own and get the mixed one (checked one by one): Twilight Forest, Oh The Biomes We've Gone, TerraBlender, Blueprint, Alex's Caves, Ice and Fire (Uranus), When Dungeons Arise, Lost Cities, Mekanism, GTCEu, Create Ore Excavation, Explorer's Compass, UtilitiX, Supplementaries' structure finder, Quark, Botania, Advanced Peripherals, Lithostitched, Occultism, Repurposed Structures, Twigs, Blue Skies, YUNG's Better Dungeons and Better End Island, Voidscape, the Bumblezone, WorldEdit, Waystones, lionfishapi, LibX, EndlessBiomes. Mods whose generation only goes through the game's generator need nothing.
• Twilight Forest and Voidscape keep their own copy of the seed; the mod keeps it at the world's value while the server runs. Without that, writing the server's settings again (/whitelist on, for example) changed Twilight Forest's biomes in the middle of a game — a fault of those mods that this one fixes in passing.
• TerraBlender with two or more region mods (Biomes O' Plenty and Regions Unexplored, say) numbers its regions in the order the mods load, which can change from one start to another, so biomes can change after a restart. That happens with or without this mod. One region mod alone is not affected.
• Seed maps, seed finders and "type the seed into another world" show a different world when given the stored seed of a mixed world. In a world made now, slime chunk finders do not work either: slime chunks follow the mixed seed.
• /locate, explorer maps, dolphins, eyes of ender and the End pillars on a dragon respawn follow the world's real generation.
• Version: built for Minecraft 1.20.1 (Forge 47). One thing a person can notice is how soon the server learns a joining player's language during a remote setup (see "Who may be there while it waits"): a moment after the player joins.
• Other mods by the same author are not needed.

What is stored, and where

Privacy

• The mod makes no connection of its own and sends nothing anywhere outside the game's own connection between a game and its server.
• During a remote setup, an administrator's game sends the server mouse positions inside the box, the game's nanosecond clock, the buttons pressed and any seed typed by hand. Nothing else, and only during the setup.
• The secret is never shown, sent or logged, not even to administrators. Only somebody with access to the server's files can read it.
• The server console and log record, during a remote setup, the names of the players who were disconnected and why, the language they were told in, who confirmed the setup and whose later press changed nothing.
• The mod adds nothing to crash reports.

Languages

English, Spanish, French, Portuguese and German, with their regional variants (19 language files). Other languages show English. The server reads the same files itself for its own window (the machine's language), for its console, and for the texts it writes to players (each player's language).

FAQ

Can players still crack the seed? They can still find the stored seed (the seed hash every game receives can confirm a guess, and some mods send it), and on its own it rebuilds nothing. With enough observation of the world a cracker can still, in principle, work out the value generation really uses, as on any vanilla world; with the bedrock step on, the bedrock pattern does not help them. The mod removes the shortcut. It does not make the world impossible to analyse.

Does it change how my worlds look? No. Same generator, same rules, same biomes and structures. Only the number fed into generation is different.

Will it change my existing world? Never. Worlds from before the mod keep generating exactly as vanilla does (the server tells you they are not protected), and worlds that already have a secret keep that same secret and generate as they were made.

Do players need to install it? No. Only the administrator who sets up a windowless server's first world through remote setup needs it, in the same build as the server.

My server is rented. How do I set it up? Put the mod on the server and start it with no world (if your host already created one, use /untraceableseed newworld confirm from the console first). Join as an operator of level 4 with the mod in your game, go through the three steps, press "Confirm and stop", and start the server again from the panel. Without the mod in your game you can finish from the console with /untraceableseed, but then generation is normal, with no secret.

Can the server owner or an operator see the secret? Not through the game. No command, screen, log line or packet carries it. Whoever can open the server's files can read untraceableseed-secret.bin.

Two of us pressed "Confirm and stop" at the same time. What happened? One of you confirmed. The other was told "Already confirmed by (name): nothing was changed." and their screen closed. There is one secret and one stop.

Can I choose my own seed and still keep the world untraceable? Yes. Choose "Manual" in the wizard, type the seed into the game's own field in singleplayer, or write it into server.properties as level-seed, and then choose "Mixed, with the mouse" on the generation step.

Does moving the mouse longer, or the date and time, make the seed stronger? Not in any way that matters. The pool starts from the operating system's cryptographic randomness and is already out of reach. The mouse adds to it; the date, the time and the 100,000 rounds add mixing, not randomness.

What happens if I lose untraceableseed-secret.bin or remove the mod? New chunks generate from the stored seed alone. Nothing breaks, but there is a visible seam between old and new terrain, and the secret cannot be recovered. Keep the file with the world and keep the mod installed for a mixed world.

Can I use an online seed map for my own world? Not for a mixed world. Given the stored seed, those tools show a different world.

Do /locate and eyes of ender still work? Yes. They follow the world's real generation.

Is the seed printed in the log or the console? No. The mod never prints a randomly drawn seed or the secret. The only number that can appear is a seed somebody typed by hand, in the console's status answer.

What if nobody is at the server's window? After 120 seconds without any use it finishes by itself with a system-random seed and normal generation, so an unattended start never hangs. To get mixed generation, somebody has to be there to move the mouse.

Can I turn mixing on for a world I already have? No. The mod only gives a secret to a world with no saved chunks, because mixing an existing world would leave a seam. /untraceableseed newworld confirm keeps your world under another name and creates a new, protected one.

I deleted my world. Will it ask again? Yes. Whenever the main world is missing, the server asks for the randomness again.

Is this an anti-X-ray? No. It protects against the seed giving the world away, not against what a client can see in the chunks it receives.

Reporting a problem

Write in the comments of this CurseForge page (you can also reach the author on X: x.com/puercoalopecico). Please include:

• the mod's version (the jar's file name) and whether it is on the server, in your game, or both;
• the Minecraft and Forge versions;
• the server's logs/latest.log (and the game's, if the problem is on a screen), from the start up to the problem;
• how the world was created (singleplayer, the server's window, remote setup or the console) and the steps that lead to the problem;
• the other mods installed, above all world-generation mods.

Do not attach untraceableseed-secret.bin, level.dat or your stored seed: they are what the mod exists to keep private.

Author: puercoalopecico · Licence: MIT