// trusted nbt editor — v11

Item NBT.
Edited.
Precisely.

A Minecraft utility mod for reading and editing item NBT data in real time. Auto-fills tags, validates structure, exports /give commands. No magic. No fluff.

fabric only open source clamav scanned sha-256 verified no telemetry

nbt-editor — live session

0 total downloads

0 versions shipped

0 active installs

0 % builds scanned

01 — NBT Tree

Visualize any held item as a live compound tree. Expand, edit, collapse — all in-game.

02 — Auto-Complete

Context-aware suggestions for tag keys and value types. Fewer typos, faster workflows.

03 — Copy / Paste

Export raw SNBT from any item. Paste onto another. Works across sessions.

04 — /give Export

One-click export as a full /give command with all NBT embedded.

05 — Validation

Validates tag structure before applying edits. Prevents malformed NBT from crashing.

06 — Schema Registry

60+ built-in item schemas — books, potions, fireworks, armour trims, and more.

$ ls releases/

All builds are ClamAV-scanned and SHA-256 checksummed before listing.

fetching releases_

$ cat changelog

Version history pulled live from the release database.

fetching changelog_

$ cat SECURITY.md

How builds are verified and how authentication works on this site.

Build Pipeline

Every uploaded .jar passes through a multi-stage verification pipeline before it becomes available for download.

✓ Magic-byte check — file must open as a valid ZIP/JAR (PK header)

↓

✓ SHA-256 deduplication — identical files rejected

↓

✓ ClamAV antivirus scan via clamd socket

↓

✓ Status set to clean — version promoted to listing

Files that fail any step are quarantined or deleted. They never appear in the release list.

3-Factor Authentication

Password
bcrypt (12 rounds). Minimum 12 characters. 10 failed attempts locks the account.

Email OTP
6-digit code delivered to verified address. Hashed with bcrypt before storage. Expires in 10 minutes.

TOTP Authenticator
Time-based one-time password (RFC 6238). Compatible with Google Authenticator, Aegis, Bitwarden.

Session Security

Sessions are stored server-side. The browser holds only a signed, httpOnly cookie. No tokens are exposed to JavaScript.

cookie flagshttpOnly · Secure · SameSite=Strict

session lifetime15 min (partial) → 8 hours (post-3FA)

rate limiting20 auth attempts / 15 min window

brute forceaccount locked after 10 failed password attempts

Transport & Headers

CSPdefault-src 'self' · no inline scripts

CORSallowlist of two origins only · credentials: true

CORPCross-Origin-Resource-Policy: same-site

rate limiter200 req / 15 min global · 20 / 15 min on /auth

Item NBT.Edited.Precisely.

Build Pipeline

3-Factor Authentication

Session Security

Transport & Headers

Item NBT.
Edited.
Precisely.