Direct answer
Get mods from their original project pages and verify the exact file. Mod installers and JARs are executable code. A filename that looks like a popular mod does not establish authorship or safety.
Recommended procedure
- Locate the author’s Modrinth, CurseForge, official site or GitHub release through the project’s own links; avoid ad-filled download mirrors and “reuploaded” JARs.
- Filter the file by Minecraft version and loader (Fabric, Forge or NeoForge). Check whether it is meant for dedicated servers, clients, or both.
- Read the list of required libraries and dependencies. For example, a Fabric mod may require Fabric API, but not every Fabric mod does.
- Look at release notes, known issues, and whether this build has an unusual change in publisher or download host. Published hashes can confirm integrity against the author’s release file.
- Keep a clean backup and test downloaded mods on a separate instance before importing them into a public server.
Why this matters
Malicious or simply incompatible mods can damage worlds, read files, crash during dedicated-server startup, or cause client/server registry mismatches. Trust checks and compatibility checks solve different problems; do both.
How to verify the result
- Launch the test server with the mod and its exact required dependencies.
- Confirm that the dedicated server boots and a test client can connect when client-side installation is required.
- Review errors such as missing dependency, wrong loader, or client-only class loading before touching the live instance.
Version and compatibility notes
Important
Reputation, antivirus scans and a well-known repository reduce risk but cannot guarantee a JAR is benign. Do not bypass warnings or execute unknown “installer” programs without verifying the publisher.
Official references
Related guides
Help us improve this article
Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.