Enshrouded Server Password Settings and User Groups

A server password is not merely a lock on an Enshrouded dedicated server. The current role system can use different passwords to decide what a joining player may do. That makes it possible to run one persistent world for builders, adventurers and visitors without giving everyone the same ability to change bases or ban players.

How do dedicated-server roles work?

Keen Games documents the role definitions in enshrouded_server.json. Each user group has a name, a password and permissions. The password used when joining determines the group and permission level. The default structure includes Admin, Friend, Guest and Visitor groups.

The exact flags are visible in the server config, including canKickBan, canAccessInventories, canEditBase, canExtendBase, and reserved slots. Keen’s Server Roles Configuration is the authority for the shipped role behavior.

Why should each group use a different password?

A shared admin password defeats the point of roles. Use one strong password for each role, distribute the least-privileged password that lets a player do what they need, and rotate a password if it leaks. Joining with an Admin password grants moderation power; it should not be used as the casual invite link for every new player.

Stop the server before editing its JSON, make a backup, then restart and test with a non-admin account. Some managed hosting panels overwrite particular config fields at startup, so check whether your provider exposes role passwords through its panel before editing the file repeatedly.

What are reserved slots?

reservedSlots is a number assigned to a group. If the lobby approaches capacity, players joining through groups without the relevant reservation can see it as full, leaving space for trusted friends or administrators. It is not a boolean switch and it does not increase the 16-player maximum.

Use it sparingly. Reserving too many slots creates a server that looks unavailable to ordinary friends even when nobody is playing. Check the configured slotCount and actual hardware limits in dedicated server requirements.

What happened to the old top-level password?

Keen notes that older dedicated configurations used a top-level password field. When the game detects that legacy password, it can create a default group to preserve earlier behavior. That helps older servers keep working, but it is not a reason to mix old and new role conventions without understanding them. Back up the config, let the server generate current group data, then deliberately set the role passwords you intend to use.

A safe role policy for a private group

1. Keep one Admin password for the owner and a backup owner.
2. Give regular builders a Friend password only if they need container and base access.
3. Use Guest or Visitor for one-off players.
4. Reserve one or two slots for trusted groups, not half the lobby.
5. Review the group list after patches or host migrations.

This is safer than giving everyone permission and then trying to undo damage after a build or Flame Altar has changed.

Related guides

• Server settings reference
• Server unavailable or full fixes
• Dedicated server ports
• Dedicated server setup

Sources: Keen Games server roles configuration and Keen Games dedicated server configuration. Last verified 2026-10-19.