Any app that asks for a Microsoft login and installs outside an app store deserves scrutiny. PojavLauncher is open source, which means the code can be read by anyone, but that alone does not make every copy of it safe. The real answer depends on your download source, the permissions you grant and how you handle your account.
Key points
- The historical launcher code is public, but the original project is now archived and no longer receives fixes.
- Third-party APKs can be modified, so the archived repository is the safest reference point for legacy files.
- An unexpected custom email-and-password form or unrelated permission request is a red flag worth verifying.
- The launcher does not license Minecraft; you still need an account that owns Java Edition.
What the project actually is
PojavLauncher is open source, and its historical code remains public. The important change is that the original project is now discontinued and its repositories are archived, so there are no new official fixes or security updates to rely on.
Open source is a safeguard, not a guarantee
Public code makes malicious behaviour harder to hide, but it does not verify the specific file on your device. A build compiled by someone else from modified source looks identical from the outside.
Who maintains it
The former volunteer team left the repository and issue history public, but the organization was archived in September 2025. Treat any file presented as a brand-new “official PojavLauncher release” with caution, because the original project is no longer publishing supported builds.
Where the real risk lives
The biggest avoidable risk is installing a repackaged build from a download portal when you cannot verify what was changed.
Repackaged APKs
Some download portals wrap apps in their own installers or add extra components. If the download process introduces a separate installer, multiple redirects or permissions that do not fit a game launcher, use the archived repository instead.
- Use the archived project repository as the reference source
- Check the package identifier before installing
- Avoid builds that request unrelated permissions such as SMS, contacts or accessibility access
Fake account login screens
A modified build could imitate a Microsoft sign-in flow, which is why the file source and the login page both matter. If the sign-in screen looks unusual, close the app and verify the build before entering credentials.
Malicious mods
The launcher does not vet mods. A mod jar runs with the same access as the game. Stick to established repositories and avoid files shared through direct links in chat groups.
Permissions and what they are for
The permission list is short and each item maps to an obvious function. Anything beyond this list should be treated as a red flag.
Storage access
Needed to store the runtime, game files, worlds and to import mods or resource packs. Without it the launcher cannot function.
Network access
Used to authenticate your account, download game assets from Mojang and fetch version manifests. Standard for any launcher.
Account safety
Your Microsoft account is more valuable than the game itself. Treat the login with the same care you would on a desktop.
Use two-factor authentication
Two-factor authentication on the Microsoft account blocks the most common takeover route even if credentials leak elsewhere.
Never enter credentials in a third-party field
Legitimate sign-in happens in an embedded Microsoft page. If a build asks for your email and password directly in its own styled form, stop immediately and uninstall.
Is it legal to use?
Running a launcher is not the issue; owning the game is. PojavLauncher launches a copy of Minecraft Java Edition that you must already own. Using it with a cracked or shared account is a licensing violation regardless of how the game is started, and offline-only builds that bypass authentication should be avoided for that reason.
Server access
Most public servers require online-mode authentication, so an unlicensed account is blocked at the door anyway.
Bans and account risk
Using the launcher itself does not trigger bans. Cheat mods loaded through it absolutely can, exactly as they would on desktop.
A short verdict
For a legacy install, the archived official repository is the best reference point. Copies from advert-driven mirrors add unnecessary risk, and the lack of ongoing maintenance means you should be more conservative, not less. Start from the archived source links, verify what you are installing and keep your Microsoft account protected with two-factor authentication.
How to check a build before you install it
A short verification pass takes a minute and rules out almost every bad copy in circulation. It is worth doing every time you install, not only the first time.
Check the source, then the package
Confirm the file came from the archived project repository, then compare its package details with the project's historical documentation. If the file source or package information does not line up, do not install it.
Read the permission list
Storage and network are expected. Requests for SMS, contacts, call logs or accessibility services do not match the normal needs of a game launcher. Treat them as a reason to stop and verify the build.
Watch the first login screen
Use the Microsoft-hosted sign-in flow you expect from the launcher. If a build asks for credentials in an unfamiliar custom form, close it and verify the file before continuing.
If you think you installed a bad copy
Acting quickly limits the damage. The order matters, because changing a password from a compromised device achieves less than it appears to.
Uninstall, then change your password from another device
Remove the app first so it cannot capture the new credentials, then change your Microsoft account password from a computer or a different phone.
Enable two-factor authentication and review sessions
Two-factor authentication blocks reuse of stolen credentials. Microsoft account settings also list recent sign-in activity, which shows whether anyone else has used the account and from where.
Reinstall from the project repository
Once the account is secured, reinstall only if you still need the legacy launcher, using the archived repository as your reference. Restore backed-up worlds carefully and recheck any mods before copying them back.
Download reminder: use the archived project repository as your reference. The download section on our homepage links straight to the archived releases.