A good portion of sites for Minecraft mods have malware or steal mods. I'd only recommend using Modrinth, MCArchive, github and whatever official pages a mod has for downloading from.
If the mod wasn't released recently then Curseforge might also be a viable option but read the section on curseforge for why I'd advise against this whenever you can
Hamachi
Conflicts with the internet, and can cause issues with authentication
I've personally had it mess up my network drivers since it installs a network driver to function
VPNs have a history of messing up how Minecraft sends packets, this can actually get you banned from servers in some cases
VPNs change how servers identify you by changing your IP, this could theroetically make you suffer a ban from the server detecting it or someone else getting IP banned and then you unluckily getting the IP that was banned
Things like paid cosmetics are against Minecraft's End User License Agreement. Refer to Any Mods you create for Minecraft: Java Edition from scratch belong to you (including pre-run Mods and in-memory Mods) and you can do whatever you want with them, as long as you don't sell them for money / try to make money from them and so long as you don’t distribute Modded Versions of the game. Although from what I can tell, they aren't in violation of the Minecraft Usage Guidelines, so from my understanding, they technically aren't doing anything wrong but I'm going to keep this here anyways :3
This includes OptiFine, Essential, Badlion, Feather and Lunar from what I know.
I'm honestly not sure why these mods aren't taken down. My assumption is either too much of a PR disaster with some of these, or not worth it. Interestingly, Mojang actually did send a cease and desist to Physics mod for having a patreon paid version so I'm not completely sure
Some clients and/or launchers will directly login to your account instead of asking for permission using a oAuth token. This means the client has FULL access to your Microsoft account. You can tell if this happens by if DOESN'T ask for a code or open your web browser to sign in. If the client you are using requires direct login to your microsoft account, Immediately uninstall the launcher and change your Microsoft Account Password as the client has FULL ACCESS TO YOUR MICROSOFT ACCOUNT AND A MINECRAFT CLIENT OR LAUNCHER SHOULD NEVER NEED THIS
Some clients will ask for administator or superuser access, the vanilla game and mods should never
require administrator access after installation.
Most clients are closed source, meaning you cannot see the code for the client
Many clients have some invasive privacy policies where they can collect a lot of information about you that Minecraft itself doesn't even collect. A Minecraft client should NEVER need access to your Internet activity, geo-location, phone number, home address?!?!?!?! WHY IS THIS IN LUNAR CLIENT'S PRIVACY POLICY??!?!?!? THEY CAN EVEN SELL IT TO OTHER COMPANIES?!??!??!?!?!?
Some clients and launchers will obfuscate their code. This makes it harder to figure out why your game crashed, and makes it harder to know what the client is ACTUALLY doing
You have far more control over what goes into a modpack opposed to a client that might have stolen mods or just edit code without telling you. Mods can also do this but it's easier to avoid them in your own modpack
Steals mods/has stolen mods in the past and has modified them, which could cause issues and is definitely suspicious
Directly modifies the vanilla client AND fabric(If you crash the game, the crashlog will explicitly state it's using Feather client's Fabric, which indicates that Fabric's name is being changed)
Suspicious behavior like obfuscating logs. Fun fact, obfuscating logs can make it difficult or even impossible to troubleshoot what's going on with your game if you encounter an issue
I remember an issue where Lunar Client had broken hit detection for a short period of time, not sure if this was actually true, if so, it shouldn't be editing player behavior
Several people have encountered Lunar Client acting like an Alt account generator, causing the game to disallow them from joining servers. IF you get a "Switch to Mojang Mode" error, that's Lunar Client.. You should switch away immediately and change your Microsoft account's password
It's possible this has changed but I recall Lunar Client using your normal .minecraft folder. This is extremely bad practice because if Lunar Client breaks somehow, it can clash with the normal launcher and either cause the launcher to exhibit the same issues or just cause other issues in general.
Their privacy policy is suspicious as hell, IF you plan on continuing to use lunar client for whatever reason, please please look at it and fully grasp what they're using. Like, A Minecraft client should NEVER need access to your Internet activity, geo-location, phone number, or home address?!?!?!?! WHY IS THIS IN LUNAR CLIENT'S PRIVACY POLICY??!?!?!?
FROM MY OWN PERSONAL TESTING, it installs suspicious certificates authorities(? I think, I genuinely can't remember) onto your computer. IF I am correct and the certificate authority thing is true, TLauncher can preform Man In The Middle attacks on your computer. Computerphile has a video explaining how these work
Stole the name and some other drama with TL Legacy/TL Legacy Launcher
It has code for crashing antiviruses. A Minecraft launcher should never do this???
Tries to profit off of piracy by providing subscriptions and cosmetics that you can recreate for free and end up being more expensive than the actual game.
Paying for the "Forever plan" on TLauncher costs about 20 USD. You can buy Minecraft "Standard Edition" for 30 USD. This includes both Java and Bedrock edition.
If you pay for TLaunchers "Popular" 3 month subscription, you will end up spending more money on TLauncher over the course of a year than you would've if you just saved the money and bought Minecraft "Standard Edition".
Ironically you'd get better value just saving up and buying the Standard Edition and using Figura, CPM, Ears, or even More Player Models(On really old versions). Figura and CPM allow you to create your own. I even have an example in my mod recommendations
I cannot stress enough, please do NOT use TLauncher. I know that if you're using this, I'm NOT going to convince you to buy the game, but there's so many better ways to play Minecraft that don't involve feeding into this disgusting company
</i> Modrinth and Prism launcher are good alternatives
Pirated Launchers(and/or account generators)
Some of these launchers or account generators might modify system files. Ironically, you actually don't need to modify ANY system files to play the game for free so any launchers doing this are probably doing it for malicious reasons
Some of these launchers will use their own jars and libraries, This absurdly bad because it makes the game less stable
Some of these launchers are closed source which is not good usually
Refer to Many launchers as many pirated launchers will do stuff in this category and some will even try to get money out of it like TLauncher
While some people may argue that "Microsoft doesn't need anymore money" or something similar. Sadly the fact of the matter is, to legally
play Minecraft, you need to buy it from minecraft.net or buy a gamecard for it from a authorized retailer like Walmart or Amazon. There's nothing we can really LEGALLY do about this
Most communities are UNABLE To help with a pirated copy of the game. We do not know what your launcher is doing to bypass authentication and that can cause problems. On top of that, it is quite literally ILLEGAL for us to help. Some
of us genuinely do want to help you but we quite literally can't.
If you really want to play the game, I'd really recommend purchasing it if you can(Especially as soon as you can since inflation is really hitting hard lately and prices are going up). If you really can't buy the game, look towards luanti(Formerly Minetest) or maybe use an open source launcher if you really must. Just be careful and please don't expect support with pirated or cracked copies of the game, refer to all of the reasons above for why Minecraft Community Support, Modded Minecraft and other Discord servers or communities CANNOT help with these launchers even if it wasn't against their rules(Which it is).
Curseforge
Curseforge has had instances of weird practices like allowing illegal copies of Iris/Sodium for a while.
Curseforge has about 25% of my screen reserved for ads compared to maybe 5% from Modrinth. Prism Launcher doesn't and Modrinth's are small in the bottom right and usually
for their own services opposed to Curseforge's google ads.
I'd only recommend using curseforge if you can't find a mod on Modrinth or MCArchive, for older versions of the game or if you have to.
</i> If you do use curseforge, I'd recommend downloading the jar for the mod directly or using Prism and recommend against using their launcher
OptiFine(On 1.14 and above<li>)
Has violated Minecraft's EULA several times in the past.
Closed source, basically nobody can see the source code, This is really bad for mod compatibility, which should be a huge worry for a mod that used to be essential for your mod list.
Can cause a lot of issues due to how it changes rendering.
Sodium or Embeddium provide far better performance, Iris or Oculus provide better shader support, and you can find alternatives with more features.
Stole a bunch of features from MCPatcher, STILL bragging about making it obsolete on it's website TO THIS DAY(Dec 12th, 2025)
</i> Note, if you're using any Minecraft version belore 1.14, most mods usually expect OptiFine and I haven't really seen any alternatives. You might be able to find some backports of Sodium like angelica if you do some looking though
Essential
Most mods that require this will force install it into your Minecraft instance without any consent and doesn't even ask you, in my experience
In my experience every time I've used it, it has installed itself to a seperate folder and you have to go hunting in your .minecraft folder
It has a tendency to clutter logs with errors that make it really really annoying to diagnose what's causing an issue. Usually if someone has essential installed, one of my first actions is to have them remove it and re-encounter the issue JUST so I can read their log
From logs I've seen, it seems to inject itself into weird places?
Possibly has DRM? It seems to check your hosts file? A Minecraft mod should probably not be doing this
While there is technically nothing wrong with just using mcreator. I'd recommend against using it since:
It's known to generate really weird code
It uses reflection in places it doesn't need to. Basically, reflection is really slow compared to just directly accessing things. Instead of just doing Object -> Field, it'll i think
have to do something like Object -> Class -> getField -> Field
In my experience, usually mods made with it less stable or laggier than mods made directly in Java or Kotlin
If possible, I'd honestly recommend learning Java over using MCreator.
Fabric and Neoforge have guides and documentation for starting out
The Vanilla Launcher
It might seem counter-intuitive but the base launcher is honestly pretty unstable and isn't the best for modding
