Security & transparency

Account and licence safeguards

Sign-in uses time-limited email codes. Website session credentials use Secure, HttpOnly cookies, and the backend stores token hashes. Sign-in and sensitive endpoints have rate limits. Administrator access is checked by the server, not just hidden in the interface.

The Windows launcher protects its local session with Windows DPAPI. Device linking uses a pseudonymous identifier and a public key; licensed requests require device proof. Server-issued licence leases are short-lived, and release information is signed so the launcher can check downloaded files.

These controls reduce risk; they do not make the software impossible to copy, reverse-engineer or attack. A signed release manifest is not the same as a Windows publisher code-signing certificate, an independent security audit or a certification.

What you will never need to send to support

• Your Microsoft/Minecraft password or a sign-in code sent to you.
• Wallet recovery phrases, private keys or full payment-card details.
• Remote control of your computer merely to verify a purchase.

Where to get the client

Use the download link on mayhemclient.xyz or your account. A public launcher download does not grant a paid licence. The licensed mod is delivered only after authentication and entitlement checks. Do not trust a copied download or an unsolicited support message merely because it uses the Mayhem name.

We do not claim approval by Mojang, Microsoft, Lunar Client or a server operator. No anti-cheat bypass, account-ban protection, FPS percentage or compatibility with every third-party modification is guaranteed.

Support and disclosure

The website support chat is connected to the operator through Telegram and the administrator panel. Do not treat it as an end-to-end encrypted channel. To report a security issue, say that it is a security report, provide a brief description and ask for a suitable way to share sensitive details before posting them.

For account, payment or device-linking issues, contact the same website support chat. Include the relevant account email or order ID so we can identify the issue. Information about personal-data requests is available in the Privacy notice.