diff --git a/.gitignore b/.gitignore
index 97510a7f..2a14e4ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,11 +11,7 @@ build/
 !**/src/test/**/build/
 
 ### IntelliJ IDEA ###
-.idea/modules.xml
-.idea/jarRepositories.xml
-.idea/compiler.xml
-.idea/libraries/
-.idea/AndroidProjectSystem.xml
+.idea/
 *.iws
 *.iml
 *.ipr
diff --git a/.idea/gradle.xml b/.idea/gradle.xml
index 25956e96..169b8d94 100644
--- a/.idea/gradle.xml
+++ b/.idea/gradle.xml
@@ -16,7 +16,7 @@
           </compositeBuild>
         </compositeConfiguration>
         <option name="externalProjectPath" value="$PROJECT_DIR$" />
-        <option name="gradleJvm" value="21" />
+        <option name="gradleJvm" value="jbr-21" />
         <option name="modules">
           <set>
             <option value="$PROJECT_DIR$" />
diff --git a/.idea/misc.xml b/.idea/misc.xml
index 5cd9a108..f16dea79 100644
--- a/.idea/misc.xml
+++ b/.idea/misc.xml
@@ -1,6 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
   <component name="ExternalStorageConfigurationManager" enabled="true" />
+  <component name="FrameworkDetectionExcludesConfiguration">
+    <file type="web" url="file://$PROJECT_DIR$" />
+  </component>
   <component name="ProjectRootManager" version="2" languageLevel="JDK_21" default="true" project-jdk-name="21" project-jdk-type="JavaSDK">
     <output url="file://$PROJECT_DIR$/out" />
   </component>
diff --git a/gradlew b/gradlew
old mode 100644
new mode 100755
diff --git a/gradlew.bat b/gradlew.bat
old mode 100644
new mode 100755
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/auth/username/UsernameResolutionService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/auth/username/UsernameResolutionService.kt
index 3b3738a3..ff16cb15 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/auth/username/UsernameResolutionService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/auth/username/UsernameResolutionService.kt
@@ -75,7 +75,10 @@ constructor(private val userService: UserService, private val profileService: Pr
       // check if the letter case changed
       if (
         correspondingPremiumProfile.name != existingUserIgnoreCase.username &&
-          correspondingPremiumProfile.name.value.equals(existingUserIgnoreCase.username.value, true)
+          correspondingPremiumProfile.name.value.equals(
+            existingUserIgnoreCase.username.value,
+            true,
+          )
       ) {
         userService.migrateUsername(existingUserIgnoreCase, correspondingPremiumProfile.name)
         return success(
@@ -87,7 +90,13 @@ constructor(private val userService: UserService, private val profileService: Pr
 
     if (existingUserIgnoreCase != null && !existingUserIgnoreCase.isPremium) {
       if (isPremiumNickname) {
-        return if (existingUserIgnoreCase.username == correspondingPremiumProfile.name) {
+        // Check if usernames match case-insensitively (allow case variants as same account)
+        val sameNameIgnoreCase =
+          existingUserIgnoreCase.username.value.equals(
+            correspondingPremiumProfile.name.value,
+            ignoreCase = true,
+          )
+        return if (sameNameIgnoreCase) {
           success(
             EncryptionType.NONE,
             PostUsernameResolutionState.NONPREMIUM_WITH_SAME_PREMIUM_NICKNAME,
@@ -131,10 +140,8 @@ constructor(private val userService: UserService, private val profileService: Pr
             )
           )
         }
-        return success(EncryptionType.ENFORCE_PREMIUM, PostUsernameResolutionState.NEW_ACCOUNT)
-      } else {
-        return success(EncryptionType.NONE, PostUsernameResolutionState.NEW_ACCOUNT)
       }
+      return success(EncryptionType.NONE, PostUsernameResolutionState.NEW_ACCOUNT)
     }
 
     throw IllegalStateException(
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt
index e32fe360..828d7a61 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt
@@ -57,16 +57,12 @@ constructor(
    *
    * @param user the user to whom the provided credentials belong
    * @param userCredentials the credentials to be stored for the user
-   * @throws IllegalArgumentException if the provided credentials do not match the user or if the
-   *   user does not require credentials
+   * @throws IllegalArgumentException if the provided credentials do not match the user
    */
   fun storeUserCredentials(user: User, userCredentials: UserCredentials) {
     require(userCredentials.userUuid == user.uuid) {
       "provided credentials do not belong to the provided user"
     }
-    require(user.credentialsRequired) {
-      "cannot store credentials for a user without credentials required property"
-    }
 
     credentialsRepository.save(userCredentials)
   }
@@ -75,12 +71,8 @@ constructor(
    * Deletes the credentials associated with the given user.
    *
    * @param user the user whose credentials are to be deleted
-   * @throws IllegalArgumentException if the user has the `credentialsRequired` property set to true
    */
   fun deleteUserCredentials(user: User) {
-    require(!user.credentialsRequired) {
-      "cannot delete credentials for a user with credentials required property"
-    }
     credentialsRepository.deleteByUser(user)
   }
 
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
index 25f60372..cad51426 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
@@ -65,8 +65,6 @@ constructor(
   }
 
   fun createAndStoreUserWithNewCredentials(user: User, password: HashedPassword) {
-    require(user.credentialsRequired) { "cannot store user without credentials required property" }
-
     txService.inTransaction {
       userRepository.save(user)
       userCredentialsService.storeUserCredentials(
@@ -83,7 +81,6 @@ constructor(
   }
 
   private fun deleteUserCredentialsUpdateUserNoTx(user: User): User {
-    val user = user.withCredentialsRequired(false)
     userRepository.save(user)
     userCredentialsService.deleteUserCredentials(user)
     return user
@@ -91,7 +88,7 @@ constructor(
 
   /**
    * Migrates a non-premium user account to a premium account using the provided Mojang ID. This
-   * updates the user's data and ensures proper handling of authentication credentials.
+   * updates the user's data and marks the user as premium. The user keeps their password.
    *
    * @param user The non-premium user to be migrated to a premium account.
    * @param mojangId The Mojang ID associated with the premium account to link to the user.
@@ -99,18 +96,10 @@ constructor(
    */
   fun migrateToPremium(user: User, mojangId: MojangId): User {
     val user = txService.inTransaction {
-      val credentials = userCredentialsService.findCredentials(user)!!
-      // require credentials only if there's 2FA enabled
-      val requireCredentials = credentials.isTwoFactorEnabled
-      val premiumUser = User.premium(user.uuid, user.username, mojangId, requireCredentials)
+      val premiumUser = User.premium(user.uuid, user.username, mojangId)
 
       userRepository.save(premiumUser)
-      if (requireCredentials) {
-        val newCredentials = credentials.withoutPassword()
-        userCredentialsService.storeUserCredentials(premiumUser, newCredentials)
-      } else {
-        userCredentialsService.deleteUserCredentials(premiumUser)
-      }
+      // User keeps their password, no credential changes needed
 
       return@inTransaction premiumUser
     }
@@ -127,23 +116,15 @@ constructor(
    * context.
    *
    * @param user The user to be migrated, which must be a premium user.
-   * @param newPassword The new hashed password to set for the user.
    * @return The updated user with non-premium status and required credentials.
    * @throws IllegalArgumentException if the user is already a premium user.
    */
-  fun migrateToNonPremium(user: User, newPassword: HashedPassword): User {
-    require(user.isPremium) { "cannot migrate non-premium user to non-premium" }
+  fun migrateToNonPremium(user: User): User {
+    require(user.isPremium) { "cannot migrate premium user to non-premium" }
 
     val user = txService.inTransaction {
-      // make sure the user has credentials required
       val nonPremiumUser = user.toNonPremium()
       userRepository.save(nonPremiumUser)
-
-      val newCredentials =
-        userCredentialsService.findCredentials(nonPremiumUser)?.withNewPassword(newPassword)
-          ?: UserCredentials.create(nonPremiumUser, newPassword, null)
-      userCredentialsService.storeUserCredentials(nonPremiumUser, newCredentials)
-
       return@inTransaction nonPremiumUser
     }
 
@@ -185,7 +166,7 @@ constructor(
    * @return The updated user with the new username.
    * @throws UsernameAlreadyTakenException if another user already takes the new username.
    * @throws IllegalArgumentException If the user is a premium user, or the new username belongs to
-   *   a premium profile.
+   *   a premium user.
    */
   fun migrateData(user: User, newUsername: Username): User {
     require(!user.isPremium) { "cannot migrate premium user data" }
@@ -226,31 +207,18 @@ constructor(
     txService.inTransaction {
       val credentials =
         userCredentialsService.findCredentials(user)
-          ?: UserCredentials.create(user, null, totpSecret)
-
-      val userWithCredentials =
-        if (!user.credentialsRequired) {
-          val user = user.withCredentialsRequired()
-          userRepository.save(user)
-          user
-        } else {
-          user
-        }
+          ?: throw IllegalStateException("User must have credentials before enabling 2FA")
 
       val newCredentials = credentials.withTotpSecret(totpSecret)
-      userCredentialsService.storeUserCredentials(userWithCredentials, newCredentials)
+      userCredentialsService.storeUserCredentials(user, newCredentials)
     }
   }
 
   fun disableTwoFactorAuth(user: User) {
     txService.inTransaction {
       val credentials = userCredentialsService.findCredentials(user)!!
-      if (credentials.isPasswordRequired) {
-        val newCredentials = credentials.withoutTotpSecret()
-        userCredentialsService.storeUserCredentials(user, newCredentials)
-      } else {
-        deleteUserCredentialsUpdateUserNoTx(user)
-      }
+      val newCredentials = credentials.withoutTotpSecret()
+      userCredentialsService.storeUserCredentials(user, newCredentials)
     }
   }
 }
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
index 66db35d9..37c812fd 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
@@ -70,9 +70,6 @@ open class MessagesConfig : OkaeriConfig() {
   var loginTooManyAttemptsError =
     TextComponent("<red>Too many login attempts. Please try again later.")
 
-  var adminCopyPasswordText =
-    "<aqua><bold><click:copy_to_clipboard:%PASSWORD%>CLICK HERE TO COPY</click>"
-
   var yourAccountDataHasBeenMigrated =
     TextComponent("<green>Your account data has been migrated to '%USERNAME%'.")
 
@@ -97,29 +94,24 @@ open class MessagesConfig : OkaeriConfig() {
     var processAlreadyInProgressError: Notice =
       Notice.chat("<red>Process is already in progress. Please wait...")
 
-    var passwordRequiredError: Notice = Notice.chat("<red>Please provide your current password.")
     var twoFactorAlreadyEnabledError: Notice =
       Notice.chat("<red>Your account has 2FA enabled already!")
 
     var missingPermissionError: Notice =
       Notice.chat("<red>You don't have permission to execute this command.")
     var invalidUsageError: Notice = Notice.chat("<red>Invalid command usage!")
+
     @Comment("Invalid usage scheme line (single text component only).")
     var invalidUsageLine: TextComponent = TextComponent("<gray> • %SCHEME%")
 
     var cantUseThisCommandNowError: Notice = Notice.chat("<red>Can't use this command right now.")
-    var commandPasswordNotSetForAccountError: Notice =
-      Notice.chat("<red>Can't execute this command right now: your account has no password set.")
+
     var commandNoPremiumAccountWithUsername: Notice =
       Notice.chat(
         "<red>Can't set this account as premium because there's no premium account with username '%USERNAME%'."
       )
     var accountAlreadyPremiumError: Notice =
       Notice.chat("<red>Account is already set as a premium one.")
-    var accountNotNonPremiumError: Notice =
-      Notice.chat(
-        "<red>Can't execute this command right now: your account is not a non-premium one."
-      )
 
     var alreadyTryingToLoginError: Notice =
       Notice.chat(
@@ -134,8 +126,7 @@ open class MessagesConfig : OkaeriConfig() {
 
     var loginPasswordOnlyInstruction: Notice =
       Notice.chat("<green>Please login using \"/login <password>\" command.</green>")
-    var loginTwoFactorOnlyInstruction: Notice =
-      Notice.chat("<green>Please login using \"/2fa <code>\" command.</green>")
+
     var loginPasswordAndTwoFactorInstruction: Notice =
       Notice.chat("<green>Please login using \"/login <password> <2fa_code>\" command.</green>")
     var loggingInInfo: Notice = Notice.chat("<yellow>Logging in, please wait...</yellow>")
@@ -213,9 +204,7 @@ open class MessagesConfig : OkaeriConfig() {
     var adminCmdPasswordSetSuccess: Notice =
       Notice.chat("<green>Success! User '%USERNAME%' password was set.")
     var adminCmdAccountMigratedToNonPremiumSuccess: Notice =
-      Notice.chat(
-        "<green>User '%USERNAME%' has been successfully migrated to non-premium mode. Their new password is: %PASSWORD_TEXT%"
-      )
+      Notice.chat("<green>User '%USERNAME%' has been successfully migrated to non-premium mode.")
     var adminCmdUserDataMigratedSuccess: Notice =
       Notice.chat(
         "<green>Success! User '%OLD_USERNAME%' data has been migrated to '%NEW_USERNAME%'."
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/credentials/UserCredentials.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/credentials/UserCredentials.kt
index f67d3d8e..d3b46f3a 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/credentials/UserCredentials.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/credentials/UserCredentials.kt
@@ -39,12 +39,9 @@ private constructor(
 ) {
 
   init {
-    require(isValid()) { "Credentials must have either password or TOTP secret" }
+    require(isValid()) { "Credentials must have a password" }
   }
 
-  val isPasswordRequired: Boolean
-    get() = hashedPassword != null
-
   val isTwoFactorEnabled: Boolean
     get() = totpSecret != null
 
@@ -68,18 +65,11 @@ private constructor(
 
   fun withNewPassword(password: HashedPassword): UserCredentials = copy(hashedPassword = password)
 
-  fun withoutPassword(): UserCredentials {
-    require(totpSecret != null) {
-      "to create credentials without password, at least totpSecret must be set"
-    }
-    return copy(hashedPassword = null)
-  }
-
   fun withTotpSecret(totpSecret: TOTPSecret): UserCredentials = copy(totpSecret = totpSecret)
 
   fun withoutTotpSecret(): UserCredentials = copy(totpSecret = null)
 
   fun isValid(): Boolean {
-    return hashedPassword != null || totpSecret != null
+    return hashedPassword != null // Must have password, TOTP is optional
   }
 }
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/user/User.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/user/User.kt
index 679dfa39..2bf7d4a3 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/user/User.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/user/User.kt
@@ -41,33 +41,26 @@ data class User
 private constructor(
   val uuid: UserUuid,
   val username: Username,
-  val credentialsRequired: Boolean,
   val mojangUuid: MojangId? = null, // null = non-premium
 ) {
   val isPremium: Boolean
     get() = mojangUuid != null
 
   companion object Factory {
-    fun nonPremium(id: UserUuid, username: Username): User = User(id, username, true)
+    fun nonPremium(id: UserUuid, username: Username): User = User(id, username)
 
-    fun premium(
-      id: UserUuid,
-      username: Username,
-      mojangUuid: MojangId,
-      requiresCredentials: Boolean = false,
-    ): User = User(id, username, requiresCredentials, mojangUuid)
+    fun premium(id: UserUuid, username: Username, mojangUuid: MojangId): User =
+      User(id, username, mojangUuid)
   }
 
   fun withNewUsername(username: Username): User {
-    return User(this.uuid, username, this.credentialsRequired, this.mojangUuid)
+    return User(this.uuid, username, this.mojangUuid)
   }
 
   fun toNonPremium(): User {
-    return copy(mojangUuid = null, credentialsRequired = true)
+    return copy(mojangUuid = null)
   }
 
-  fun withCredentialsRequired(required: Boolean = true) = copy(credentialsRequired = required)
-
   fun toAuthUser(): AuthUser {
     return object : AuthUser {
       override fun getUUID(): UUID {
@@ -85,6 +78,6 @@ private constructor(
   }
 
   override fun toString(): String {
-    return "User(id=$uuid, username=$username, mojangUuid=$mojangUuid, credentialsRequired=$credentialsRequired)"
+    return "User(id=$uuid, username=$username, mojangUuid=$mojangUuid)"
   }
 }
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt
index 557c8bbd..5cefe17f 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt
@@ -52,12 +52,10 @@ open class LoginAuthSession<T : PlayerAdapter>(
    * Authenticates the session owner using a combination of password and two-factor authentication
    * code if required.
    *
-   * @param password the raw (not hashed) password to authenticate the user, can be null if not
-   *   required
+   * @param password the raw (not hashed) password to authenticate the user
    * @param twoFactorCode the two-factor authentication code, can be null if 2FA is not enabled
    * @return CompletableFuture with AuthTaskResult
-   * @throws IllegalArgumentException if `password` or `twoFactorCode` is required by the user
-   *   credentials but not provided
+   * @throws IllegalArgumentException if `password` is null (always required)
    * @throws EncryptionTaskAlreadyQueuedException if an encryption task is already queued
    */
   fun enqueueAuthTask(
@@ -83,12 +81,12 @@ open class LoginAuthSession<T : PlayerAdapter>(
   }
 
   /**
-   * Validates credentials and enqueues password verification if required.
+   * Validates credentials and enqueues password verification.
    *
-   * @param password the raw password, can be null if not required
-   * @param twoFactorCode the 2FA code, can be null if not required
+   * @param password the raw password (always required)
+   * @param twoFactorCode the 2FA code, can be null if not enabled
    * @return CompletableFuture with AuthTaskResult
-   * @throws IllegalArgumentException if `password` or `twoFactorCode` is required but not provided
+   * @throws IllegalArgumentException if `password` is null
    * @throws EncryptionTaskAlreadyQueuedException if an encryption task is already queued
    */
   private fun tryAuth(
@@ -102,28 +100,24 @@ open class LoginAuthSession<T : PlayerAdapter>(
       }
     }
 
-    if (userCredentials.isPasswordRequired) {
-      val future = CompletableFuture<AuthTaskResult>()
-      require(password != null) { "password parameter is required by user credentials" }
-      userCredentialsService
-        .enqueueVerifyPassword(userCredentials, password, playerAdapter.identifier)
-        .whenComplete { isCorrect, throwable ->
-          if (throwable != null) {
-            future.completeExceptionally(throwable)
-            return@whenComplete
-          }
-          if (isCorrect) {
-            future.complete(AuthTaskResult.Success)
-          } else {
-            future.complete(AuthTaskResult.WrongCredentials)
-          }
+    // Password is always required
+    val future = CompletableFuture<AuthTaskResult>()
+    require(password != null) { "password parameter is required" }
+    userCredentialsService
+      .enqueueVerifyPassword(userCredentials, password, playerAdapter.identifier)
+      .whenComplete { isCorrect, throwable ->
+        if (throwable != null) {
+          future.completeExceptionally(throwable)
+          return@whenComplete
         }
+        if (isCorrect) {
+          future.complete(AuthTaskResult.Success)
+        } else {
+          future.complete(AuthTaskResult.WrongCredentials)
+        }
+      }
 
-      return future
-    }
-
-    // 2fa was the only one required and it passed successfully
-    return CompletableFuture.completedFuture(AuthTaskResult.Success)
+    return future
   }
 
   sealed class AuthTaskResult {
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/persistence/mapper/UserMapper.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/persistence/mapper/UserMapper.kt
index a9f0bae0..7a3c4187 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/persistence/mapper/UserMapper.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/persistence/mapper/UserMapper.kt
@@ -30,7 +30,6 @@ fun User.toRecord(): UserRecord =
     mojangUuid = mojangUuid?.value,
     username = username.value,
     usernameLowercase = username.value.lowercase(),
-    credentialsRequired = credentialsRequired,
   )
 
 fun UserRecord.toDomain(): User =
@@ -39,7 +38,6 @@ fun UserRecord.toDomain(): User =
       id = UserUuid(uuid),
       username = Username(username),
       mojangUuid = MojangId(mojangUuid),
-      requiresCredentials = credentialsRequired,
     )
   } else {
     User.nonPremium(id = UserUuid(uuid), username = Username(username))
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/migrate/migrator/librelogin/LibreLoginMigrator.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/migrate/migrator/librelogin/LibreLoginMigrator.kt
index 6f1f1c79..fd2d528e 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/migrate/migrator/librelogin/LibreLoginMigrator.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/migrate/migrator/librelogin/LibreLoginMigrator.kt
@@ -113,19 +113,21 @@ constructor(
       return
     }
 
-    val credentialsRequired: Boolean
+    // All users must have credentials (password or TOTP)
     if (lUser.secret != null || hashedPassword != null) {
       val totpSecret = lUser.secret?.let { TOTPSecret(it) }
       val credentials = UserCredentials.create(userUuid, hashedPassword, totpSecret)
       userCredentialsRepository.save(credentials)
-      credentialsRequired = true
     } else {
-      credentialsRequired = false
+      logger.info(
+        "User ${lUser.lastNickname}:${lUser.uuid} has no password or 2FA secret which is an invalid record. Skipping record..."
+      )
+      return
     }
 
     val targetUser =
       if (isPremium) {
-        User.premium(userUuid, username, MojangId(lUser.premiumUuid!!), credentialsRequired)
+        User.premium(userUuid, username, MojangId(lUser.premiumUuid!!))
       } else {
         User.nonPremium(userUuid, username)
       }
diff --git a/navauth-common/src/test/kotlin/integration/auth/UsernameResolutionServiceIntegrationTests.kt b/navauth-common/src/test/kotlin/integration/auth/UsernameResolutionServiceIntegrationTests.kt
index 0e886dd1..bb095691 100644
--- a/navauth-common/src/test/kotlin/integration/auth/UsernameResolutionServiceIntegrationTests.kt
+++ b/navauth-common/src/test/kotlin/integration/auth/UsernameResolutionServiceIntegrationTests.kt
@@ -55,7 +55,7 @@ class UsernameResolutionServiceIntegrationTests {
   }
 
   @Test
-  fun `new premium user returns success premium encryption type`() {
+  fun `new premium user returns success none encryption type`() {
     val username = Username(generateRandomString(10))
     fakeProfileService.addProfile(username, MojangProfile(MojangId(UUID.randomUUID()), username))
 
@@ -63,7 +63,7 @@ class UsernameResolutionServiceIntegrationTests {
 
     assertEquals(
       UsernameResResult.Success(
-        EncryptionType.ENFORCE_PREMIUM,
+        EncryptionType.NONE,
         PostUsernameResolutionState.NEW_ACCOUNT,
       ),
       result,
@@ -117,7 +117,7 @@ class UsernameResolutionServiceIntegrationTests {
   }
 
   @Test
-  fun `existing nonpremium user conflict with different case premium username returns failure`() {
+  fun `existing nonpremium user conflict with different case premium username returns success`() {
     val username = Username(generateRandomString(10))
     val premiumUsername = Username(invertCase(username.value))
     val premiumProfile = MojangProfile(MojangId(UUID.randomUUID()), premiumUsername)
@@ -128,8 +128,9 @@ class UsernameResolutionServiceIntegrationTests {
     val result = usernameResolutionService.resolveUsernameConflicts(username, existingUser)
 
     assertEquals(
-      UsernameResResult.Failure(
-        UsernameResFailureReason.NonPremiumWithPremiumConflict(premiumUsername.value)
+      UsernameResResult.Success(
+        EncryptionType.NONE,
+        PostUsernameResolutionState.NONPREMIUM_WITH_SAME_PREMIUM_NICKNAME,
       ),
       result,
     )
diff --git a/navauth-common/src/test/kotlin/unit/auth/UsernameResolutionServiceTests.kt b/navauth-common/src/test/kotlin/unit/auth/UsernameResolutionServiceTests.kt
index 57e1a671..7ec808ad 100644
--- a/navauth-common/src/test/kotlin/unit/auth/UsernameResolutionServiceTests.kt
+++ b/navauth-common/src/test/kotlin/unit/auth/UsernameResolutionServiceTests.kt
@@ -52,7 +52,7 @@ class UsernameResolutionServiceTests :
       service = UsernameResolutionService(mockUserService, mockProfileService)
     }
 
-    test("new premium user returns success, premium encryption type") {
+    test("new premium user returns success, none type") {
       val username = Username(generateRandomString(10))
       val premiumProfile = MojangProfile(MojangId(UUID.randomUUID()), username)
       every { mockProfileService.fetchProfileInfo(username, any()) } returns premiumProfile
@@ -62,7 +62,7 @@ class UsernameResolutionServiceTests :
 
       result shouldBe
         UsernameResResult.Success(
-          EncryptionType.ENFORCE_PREMIUM,
+          EncryptionType.NONE,
           PostUsernameResolutionState.NEW_ACCOUNT,
         )
     }
@@ -105,7 +105,7 @@ class UsernameResolutionServiceTests :
       val premiumProfile = MojangProfile(MojangId(UUID.randomUUID()), username)
       every { mockProfileService.fetchProfileInfo(username, any()) } returns premiumProfile
       val existingUser =
-        User.premium(UserUuid(premiumProfile.uuid.value), username, premiumProfile.uuid, false)
+        User.premium(UserUuid(premiumProfile.uuid.value), username, premiumProfile.uuid)
 
       val result = service.resolveUsernameConflicts(username, existingUser)
 
@@ -127,7 +127,7 @@ class UsernameResolutionServiceTests :
         UsernameResResult.Success(EncryptionType.NONE, PostUsernameResolutionState.NO_CHANGE)
     }
 
-    test("existing nonpremium user conflict with different case premium username returns failure") {
+    test("existing nonpremium user conflict with different case premium username returns success") {
       val username = Username(generateRandomString(10))
       // make sure the premium profile has a different username case
       val premiumUsername = Username(invertCase(username.value))
@@ -138,8 +138,9 @@ class UsernameResolutionServiceTests :
       val result = service.resolveUsernameConflicts(username, existingUser)
 
       result shouldBe
-        UsernameResResult.Failure(
-          UsernameResFailureReason.NonPremiumWithPremiumConflict(premiumUsername.value)
+        UsernameResResult.Success(
+          EncryptionType.NONE,
+          PostUsernameResolutionState.NONPREMIUM_WITH_SAME_PREMIUM_NICKNAME,
         )
     }
 
@@ -178,8 +179,7 @@ class UsernameResolutionServiceTests :
       val premiumProfile = MojangProfile(MojangId(UUID.randomUUID()), username)
       every { mockProfileService.fetchProfileInfo(connUsername, any()) } returns premiumProfile
       every { mockUserService.findUserByMojangUuid(MojangId(any())) } returns null
-      val existingUser =
-        User.premium(UserUuid(UUID.randomUUID()), username, premiumProfile.uuid, false)
+      val existingUser = User.premium(UserUuid(UUID.randomUUID()), username, premiumProfile.uuid)
 
       val result = service.resolveUsernameConflicts(connUsername, existingUser)
 
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceChangePasswordAdminCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceChangePasswordAdminCommand.kt
index 8de50f8d..3d6ad350 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceChangePasswordAdminCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceChangePasswordAdminCommand.kt
@@ -62,14 +62,6 @@ constructor(
   ) {
     val user = userArgumentResolver.resolve(usernameOrUuidRaw)
 
-    if (user.isPremium) {
-      multification
-        .create(sender) { it.multification.adminCmdAccountIsPremiumError }
-        .placeholder("%USERNAME%", user.username.value)
-        .send()
-      return
-    }
-
     multification.create(sender) { it.multification.adminCmdPasswordSetUpdating }.send()
 
     try {
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceCrackedAdminCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceCrackedAdminCommand.kt
index 51cea2f3..f21f2362 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceCrackedAdminCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceCrackedAdminCommand.kt
@@ -26,18 +26,13 @@ import dev.rollczi.litecommands.annotations.command.Command
 import dev.rollczi.litecommands.annotations.context.Context
 import dev.rollczi.litecommands.annotations.execute.Execute
 import dev.rollczi.litecommands.annotations.permission.Permission
-import java.util.Optional
 import pl.spcode.navauth.common.annotation.Description
 import pl.spcode.navauth.common.application.credentials.UserCredentialsService
-import pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.command.user.UserArgumentResolver
 import pl.spcode.navauth.common.command.user.UsernameOrUuidRaw
-import pl.spcode.navauth.common.extension.StringExtensions.Companion.applyPlaceholders
-import pl.spcode.navauth.common.shared.utils.StringUtils.Companion.generateRandomString
 import pl.spcode.navauth.velocity.command.Permissions
 import pl.spcode.navauth.velocity.multification.VelocityMultification
-import pl.spcode.navauth.velocity.util.CommandSourceUtils
 
 @Command(name = "forcecracked")
 @Permission(Permissions.ADMIN_FORCE_CRACKED)
@@ -59,7 +54,6 @@ constructor(
   fun forceCrackedMode(
     @Context sender: CommandSource,
     @Arg(value = "username|uuid") usernameOrUuidRaw: UsernameOrUuidRaw,
-    @Arg(value = "newPassword") newPasswordOpt: Optional<String>,
   ) {
     val user = userArgumentResolver.resolve(usernameOrUuidRaw)
 
@@ -71,29 +65,10 @@ constructor(
       return
     }
 
-    val newPassword = newPasswordOpt.orElseGet { generateRandomString(8) }
-
-    try {
-      userCredentialsService.enqueueHashPassword(newPassword, user.uuid.value).thenAccept {
-        hashedPassword ->
-        userService.migrateToNonPremium(user, hashedPassword)
-
-        val passwordText =
-          if (CommandSourceUtils.isConsoleOrRcon(sender)) {
-            "$newPassword"
-          } else {
-            val placeholders = mapOf(Pair("PASSWORD", newPassword))
-            multification.config.adminCopyPasswordText.applyPlaceholders(placeholders)
-          }
-
-        multification
-          .create(sender) { it.multification.adminCmdAccountMigratedToNonPremiumSuccess }
-          .placeholder("%USERNAME%", user.username.value)
-          .placeholder("%PASSWORD_TEXT%", passwordText)
-          .send()
-      }
-    } catch (_: EncryptionTaskAlreadyQueuedException) {
-      multification.create(sender) { it.multification.processAlreadyInProgressError }.send()
-    }
+    userService.migrateToNonPremium(user)
+    multification
+      .create(sender) { it.multification.adminCmdAccountMigratedToNonPremiumSuccess }
+      .placeholder("%USERNAME%", user.username.value)
+      .send()
   }
 }
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/PlayerLookupAdminCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/PlayerLookupAdminCommand.kt
index 3abbd74e..9bb0d0e5 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/PlayerLookupAdminCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/PlayerLookupAdminCommand.kt
@@ -64,7 +64,6 @@ constructor(
     val isPremium = user.isPremium
     val credentials = credentialsService.findCredentials(user)
     val isTwoFactorEnabled = credentials?.isTwoFactorEnabled ?: false
-    val isPasswordEnabled = credentials?.isPasswordRequired ?: false
     val username = user.username
     val uuid = user.uuid
     val mojangUuid = user.mojangUuid?.value
@@ -84,7 +83,6 @@ constructor(
 • <white>Premium:</white> <blue>${checkedIcon(isPremium)}</blue>
 • <white>UUID:</white> <dark_gray>$uuid</dark_gray> <click:copy_to_clipboard:$uuid><hover:show_text:"<dark_gray>Copy"><blue><u>[copy]</u></blue></hover></click>
 $mojangLine
-• <white>Password:</white> <blue>${checkedIcon(isPasswordEnabled)}</blue>
 • <white>2FA:</white> <blue>${checkedIcon(isTwoFactorEnabled)}</blue>
 • <white>Last IP:</white> <gray><click:copy_to_clipboard:$lastIp><hover:show_text:${lastIp ?: "-"}><b>HOVER TO REVEAL</b></hover> <hover:show_text:"<dark_gray>Copy"><blue><u>[copy]</u></blue></hover></click>
 
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/ChangePasswordCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/ChangePasswordCommand.kt
index 41d5316d..aa1a2001 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/ChangePasswordCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/ChangePasswordCommand.kt
@@ -60,18 +60,8 @@ constructor(
   ) {
     val user = userService.findUserByExactUsername(sender.username)!!
 
-    if (user.isPremium) {
-      multification.send(sender) { it.multification.accountNotNonPremiumError }
-      return
-    }
-
     val credentials = userCredentialsService.findCredentials(user)!!
 
-    if (!credentials.isPasswordRequired) {
-      multification.send(sender) { it.multification.commandPasswordNotSetForAccountError }
-      return
-    }
-
     try {
       userCredentialsService
         .enqueueVerifyPassword(credentials, currentPassword, sender.uniqueId)
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt
index 9b164024..e955a20c 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt
@@ -109,7 +109,7 @@ constructor(
 
     session as VelocityLoginAuthSession
 
-    if (!session.userCredentials.isTwoFactorEnabled || session.userCredentials.isPasswordRequired) {
+    if (!session.userCredentials.isTwoFactorEnabled) {
       multification.send(sender) { it.multification.cantUseThisCommandNowError }
       return
     }
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/PremiumAccountCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/PremiumAccountCommand.kt
index 581ee9ef..b018c549 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/PremiumAccountCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/PremiumAccountCommand.kt
@@ -73,6 +73,6 @@ constructor(
     }
 
     userService.migrateToPremium(user, mojangProfile.uuid)
-    multification.create(sender) { it.multification.accountMigrationSuccess }
+    multification.create(sender) { it.multification.accountMigrationSuccess }.send()
   }
 }
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/TwoFactorSetupCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/TwoFactorSetupCommand.kt
index e923b7e6..1d0111f9 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/TwoFactorSetupCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/TwoFactorSetupCommand.kt
@@ -27,11 +27,9 @@ import dev.rollczi.litecommands.annotations.command.RootCommand
 import dev.rollczi.litecommands.annotations.context.Context
 import dev.rollczi.litecommands.annotations.execute.Execute
 import java.util.Optional
-import java.util.concurrent.CompletableFuture
 import net.kyori.adventure.text.minimessage.MiniMessage
 import pl.spcode.navauth.common.annotation.Description
 import pl.spcode.navauth.common.application.credentials.UserCredentialsService
-import pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.command.exception.MissingPermissionException
 import pl.spcode.navauth.common.config.MessagesConfig
@@ -74,51 +72,24 @@ constructor(
 
     val user = userService.findUserByUuid(UserUuid(sender.uniqueId))!!
     val credentials = userCredentialsService.findCredentials(user)
+
     if (credentials?.isTwoFactorEnabled == true) {
       multification.send(sender) { it.multification.twoFactorAlreadyEnabledError }
       return
     }
 
-    if (credentials?.isPasswordRequired == true) {
-      if (currentPassword.isEmpty) {
-        multification.send(sender) { it.multification.passwordRequiredError }
-        return
-      }
-
-      try {
-        userCredentialsService
-          .enqueueVerifyPassword(credentials, currentPassword.get(), sender.uniqueId)
-          .whenComplete { isCorrect, throwable ->
-            CompletableFuture.supplyAsync {
-              if (throwable != null) {
-                multification.send(sender) { it.multification.unexpectedErrorOccurred }
-                return@supplyAsync
-              }
-              if (!isCorrect) {
-                multification.send(sender) { it.multification.wrongCredentialsError }
-                return@supplyAsync
-              }
-
-              val secret = TOTP2FA().generateSecret()
-              val session =
-                totpSetupSessionFactory.createSession(VelocityPlayerAdapter(sender), secret)
-              totpSetupSessionService.registerSession(UserUuid(sender.uniqueId), session)
-
-              val remainingSeconds = TotpSetupSessionService.SESSION_LIFETIME_SECONDS
-              multification
-                .create()
-                .player(sender.uniqueId)
-                .notice(messages.multification.twoFactorSetupInstruction)
-                .placeholder("%SECRET%", secret.value)
-                .placeholder("%REMAINING_SECONDS%", remainingSeconds.toString())
-                .send()
-            }
-          }
-      } catch (_: EncryptionTaskAlreadyQueuedException) {
-        multification.send(sender) { it.multification.processAlreadyInProgressError }
-      }
-      return
-    }
+    val secret = TOTP2FA().generateSecret()
+    val session = totpSetupSessionFactory.createSession(VelocityPlayerAdapter(sender), secret)
+    totpSetupSessionService.registerSession(UserUuid(sender.uniqueId), session)
+
+    val remainingSeconds = TotpSetupSessionService.SESSION_LIFETIME_SECONDS
+    multification
+      .create()
+      .player(sender.uniqueId)
+      .notice(messages.multification.twoFactorSetupInstruction)
+      .placeholder("%SECRET%", secret.value)
+      .placeholder("%REMAINING_SECONDS%", remainingSeconds.toString())
+      .send()
   }
 
   @Async
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/infra/auth/VelocityLoginAuthSession.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/infra/auth/VelocityLoginAuthSession.kt
index 633c9b5c..36e200da 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/infra/auth/VelocityLoginAuthSession.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/infra/auth/VelocityLoginAuthSession.kt
@@ -67,12 +67,10 @@ class VelocityLoginAuthSession(
         .schedule()
 
     val notification =
-      if (userCredentials.isPasswordRequired && !userCredentials.isTwoFactorEnabled) {
-        messagesConfig.multification.loginPasswordOnlyInstruction
-      } else if (!userCredentials.isPasswordRequired && userCredentials.isTwoFactorEnabled) {
-        messagesConfig.multification.loginTwoFactorOnlyInstruction
-      } else {
+      if (userCredentials.isTwoFactorEnabled) {
         messagesConfig.multification.loginPasswordAndTwoFactorInstruction
+      } else {
+        messagesConfig.multification.loginPasswordOnlyInstruction
       }
 
     notifyMessageTask =
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/LoginListeners.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/LoginListeners.kt
index 411ff62e..3337b2cc 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/LoginListeners.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/LoginListeners.kt
@@ -211,15 +211,7 @@ constructor(
     val existingUser = handshakeSession.existingUser
     val uniqueSessionId = VelocityUniqueSessionId(player)
     if (handshakeSession.requestedEncryptionType == EncryptionType.ENFORCE_PREMIUM) {
-      if (existingUser != null) {
-        if (existingUser.credentialsRequired) {
-          val session =
-            authSessionFactory.createLoginAuthSession(player, uniqueSessionId, existingUser)
-          session.state = AuthSessionState.WAITING_FOR_ALLOCATION
-          return
-        }
-      }
-
+      // Premium player - auto-authenticate
       val session = authSessionFactory.createPremiumAuthSession(player, uniqueSessionId)
       // we are in postLogin event, so we can assume
       // that velocity did the verification for us
@@ -229,6 +221,7 @@ constructor(
       session.authenticate()
       return
     } else if (handshakeSession.requestedEncryptionType == EncryptionType.NONE) {
+      // Offline/cracked player - show login/register
       val session =
         if (existingUser != null) {
           authSessionFactory.createLoginAuthSession(player, uniqueSessionId, existingUser)