You want a launcher for modded Minecraft, and two names keep coming up: Prism Launcher and TLauncher. Before you install either, you want to know if it is safe, free and legal. Prism Launcher is an open source launcher for the copy of Minecraft you bought. TLauncher is best known as a way to play without buying the game. We checked everything below on 31 October 2026 against Prism's source code and site, TLauncher's own pages, Malwarebytes and Mojang's EULA.
Quick answer: Is Prism Launcher safe? Yes, if you download it from prismlauncher.org or a package manager listed there and keep it updated. It is free and open source under GPL 3.0, its builds are signed, it signs you in on Microsoft's own page, and its security bugs are fixed in public. The latest, which let a malicious CurseForge modpack move and delete files, was fixed in 11.1.1 on 28 September 2026. TLauncher is another story: Malwarebytes detects it as PUP.Optional.TLauncher, "a cracked launcher for Minecraft", its code is not public, and by its own account it shows ads and sends details about your PC. Use Prism with the Microsoft account that owns Minecraft.
Reading in Indonesian? Apakah Prism Launcher aman? answers the same safety question in Bahasa Indonesia.
Prism Launcher vs TLauncher at a Glance
| Prism Launcher | TLauncher | |
|---|---|---|
| Made by | An open source project with 346 contributors on GitHub | TLauncher Inc., with an address in the Seychelles |
| Version on 31 October 2026 | 11.1.1, released 28 September 2026 | 2.9319, according to its home page |
| Source code | Public, GPL 3.0 | Not published |
| Price | Free, funded by donations through Open Collective | Free with ads, plus a paid Premium plan |
| Signing in | On Microsoft's own page, in your browser or with a device code | For a licensed account, its site says to "log in with your email and password" |
| Ads and data | No ad, analytics or telemetry component in the 11.1.1 source | "The software contains ads"; sends PC details and game activity, with a partial opt-out |
| Security tools | Signed builds for Windows, macOS and Linux | Malwarebytes detects it as PUP.Optional.TLauncher |
| Online mode servers | Yes, with the Microsoft account that owns Minecraft | Not with a TLauncher account, Premium included |
| Modpacks | CurseForge, Modrinth, ATLauncher, FTB and Technic | Its own catalogue of mods, maps and resource packs |
Is Prism Launcher Safe?
Yes, on two conditions: download it from the official site or a package manager that site lists, and keep it updated. Its record is not spotless, but Prism fixes its problems in public.
Why You Can Trust Prism Launcher
- Open source. The code is on GitHub under GPL 3.0, so anyone can read what the launcher does.
- Your password stays with Microsoft. Prism sends you to Microsoft's own sign-in page in your browser, or shows a code you enter on Microsoft's site. Both login steps are in its source code, and neither asks for your password inside the launcher.
- Signed builds. Prism's build scripts sign Windows builds through Microsoft's Azure code signing service, sign and notarize macOS builds with an Apple certificate, and sign Linux AppImages with GPG. We read the signature block of the 11.1.1 Windows installer: its certificate comes from Microsoft's ID Verified code signing and is issued to Seth Flynn, a public member of the PrismLauncher organization on GitHub. That is the signer name Windows shows.
- No ads or analytics. We searched all 2,059 file paths of the 11.1.1 source and found no analytics, telemetry or ad component. The launcher does go online, for things like update checks, downloading Minecraft, Java and mod loaders, and searching Modrinth and CurseForge.
- Problems are announced. Fixed vulnerabilities are listed on the security advisories page, and Prism posts malware warnings about mods, such as the fractureiser warning of June 2023.
Prism Launcher's Security History
Here is everything Prism has published as a security problem, checked against the advisories page and the release notes on 31 October 2026:
| Published | Versions affected | What could happen | Fixed in |
|---|---|---|---|
| 4 February 2023 | Before 6.2 | CVE-2023-25304, rated high: importing a malicious .mrpack file could place or replace scripts and config files anywhere on disk, which can lead to running code | 6.2 |
| 15 February 2023 | 6.3 and older | Rated high: file names with ../ in a modpack zip let the pack write files anywhere on disk during extraction | 7.0 |
| 24 November 2024 | 8.4 and older | Rated medium: Prism checked the SHA512 hash of Modrinth files only when no SHA1 hash was given, so swapped files could get through | 9.0 |
| 28 September 2026 | 11.1.0 | Malicious CurseForge modpacks "could move and delete files from arbitrary paths the launcher currently has access to" | 11.1.1 |
For the last one, the 11.1.1 announcement promised more information "in the upcoming week", but on 31 October 2026 GitHub still had no advisory for it, so the table quotes the release post. Prism's changelogs also list two path traversal fixes without an advisory or a description of the risk: for zip files in 11.0.0 (April 2026) and for ATLauncher packs in 11.0.3 (July 2026).
Every bug in the table came in through a modpack with malicious or swapped files. That tells you where the real risk is.
What Actually Puts You at Risk
- Fake download sites and modified builds. Get Prism from prismlauncher.org, its GitHub releases or a package manager listed on that page. Skip "modified" versions on other sites.
- Modpacks from unknown sources. Prism's own advice after the 11.1.0 bug: "it is best to only use modpacks directly from Modrinth or CurseForge", and "Avoid modpacks sent over platforms like Discord unless you are able to personally verify they are safe". Since 11.1.0, Prism also warns about untrusted mods when you import a Modrinth or CurseForge modpack file by hand.
- Fake Discord invites. In January 2026 Prism warned that its old invite link, discord.gg/prismlauncher, was no longer theirs and was being used to steal Minecraft accounts. Discord has since reserved that link. Use the invite on prismlauncher.org, and in Prism's words, "never trust servers which require you to 'link'/verify your Minecraft account to join".
- Old versions. Everything in the table is fixed, but only after you update with the launcher's Update button or your package manager. In April 2026 Prism asked Windows, AppImage and Linux Portable users to update to 11.0.2 by hand because the updater had broken, so if you are on 11.0.1 or older, download the current release from the website.
- The mods themselves. A launcher cannot make a malicious mod safe. Our Modrinth and CurseForge safety guides cover that side.
How to Install Prism Launcher Safely
Windows: download the installer from prismlauncher.org, or install it with WinGet:
winget install --exact PrismLauncher.PrismLauncher
Linux: Flathub, which Prism calls its "primary method of distribution on Linux". If your app center already shows Flathub apps, you only need the second command:
flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
flatpak install flathub org.prismlauncher.PrismLauncher
macOS (Monterey or later): open the .zip from prismlauncher.org and drag Prism Launcher to Applications, or use Homebrew:
brew install --cask prismlauncher
On Windows, check the installer before you run it: right-click it, choose Properties and open the Digital Signatures tab. No such tab means the file is not signed, so delete it and download it again from prismlauncher.org. After that, install modpacks from the CurseForge and Modrinth tabs inside Prism rather than from files someone sends you.
Is Prism Launcher Legal?
Yes. Prism is a launcher for the Minecraft you bought: you add the Microsoft account that owns the game, and Prism starts it with your licence. It is a third-party launcher: its site says "Not affiliated with Mojang or Microsoft". Prism has offline accounts too, but they are no way around buying the game. Try to add one first and Prism stops you with: "You must add a Microsoft account that owns Minecraft before you can add an offline account." Since 11.0.3 it can also start your game in offline mode when Microsoft's sign-in servers are down.
Is TLauncher Safe?
Not by the standards above. Four things stand out:
- Security tools flag it. Malwarebytes has a detection page for PUP.Optional.TLauncher, which it calls "a cracked launcher for Minecraft". It blocks the program "so users can make an informed choice" and warns that users "run the risk of installing bundled other PUPs, adware, or malware". PUP means potentially unwanted program: Malwarebytes does not call it a virus, but it does block it.
- Nobody outside the company can check it. TLauncher's site offers an installer and a .jar file but no source code, and its footer names TLauncher Inc.
- It collects data and shows ads. Its privacy policy says the launcher sends your Java version, screen resolution, operating system, country, launcher version, "the unique software UID", GPU and CPU, plus when you load or join a game. Its "Disable sending anonymous statistics" setting turns off the PC details, but "The very fact of running the program will still be sent to our server". The policy also names Yandex Metrika and ad companies such as Google and Yandex, and the site footer says "The software contains ads".
- It asks for your password. For a licensed account, TLauncher's home page tells you to "just log in with your email and password" inside the launcher. Type your Microsoft password only on Microsoft's own sign-in page, which is where Prism sends you.
Even TLauncher's own extra protection, "TL Guard" with "Analysis of suspicious mods, textures and maps", is a paid feature, according to its Premium page.
Is TLauncher Legal?
Using TLauncher to play without buying Minecraft is piracy, and that goes for every "cracked" launcher. Mojang's EULA says "When you buy our games, that means you can download, install, and play them", and it forbids giving "copies of our game software or content to anyone else". Malwarebytes adds that using a cracked launcher "violates Minecraft's End User License Agreement (EULA)" and "is considered illegal in most regions".
Can TLauncher Players Join Online Mode Servers?
Not with a TLauncher account. A Java server with online-mode=true only lets in players verified with Minecraft's account database, and true is the default in server.properties, according to the Minecraft Wiki. A TLauncher account is not a Microsoft account that owns Minecraft, so it fails that check, and TLauncher's Premium page itself warns that "Premium does not allow you to play on licensed servers". You need an account that owns Minecraft, and with that account Prism is the safer launcher. Prism's offline accounts can't join those servers either.
If you run the server, leave online mode on: the wiki warns that with it off, "hackers with fake accounts can connect". For a modpack with friends, everyone installs the same pack in Prism and joins with their own account. On our Minecraft modpack hosting, the panel's modpack installer sets up listed CurseForge and Modrinth packs, and you upload the server files of any other pack over SFTP.
Is Prism Launcher Better Than TLauncher?
For anyone who owns Minecraft, yes. Prism sets up Forge, NeoForge, Fabric or Quilt per instance, gives every instance its own mods, Java and memory settings, can download the right Java for you, and installs modpacks from five sources. It does all that with public code, signed builds, announced fixes and no ads.
To switch, install Prism from prismlauncher.org, add your Microsoft account, create an instance and copy your world folders into its saves folder. Our Prism Launcher setup guide walks through it. Still choosing? Our Prism Launcher vs Modrinth App vs CurseForge comparison covers the other launchers, and our list of the best modpacks of 2026 gives you something to play.
FAQ
Is Prism Launcher free and safe? Yes. It costs nothing, is open source under GPL 3.0 and is funded by donations. It is safe when you download it from prismlauncher.org or a package manager listed there and keep it updated: 11.1.1, still the latest release on 31 October 2026, fixed a CurseForge modpack bug from 11.1.0.
Is Prism Launcher a virus? No. It is open source software with signed builds, and you can read its code on GitHub. Download it from the official site and check the Digital Signatures tab of the Windows installer before you run it.
Can Prism Launcher steal my Microsoft account? No. It signs you in on Microsoft's own page and never sees your password. The account thefts Prism warned about in January 2026 came from a fake Discord server using its old invite link, not from the launcher.
Is TLauncher safe in 2026? Malwarebytes detects it as PUP.Optional.TLauncher, a cracked launcher, and warns about bundled PUPs, adware or malware. Its code is not public, it shows ads and sends details about your PC, and its site tells you to type your password into the launcher. Use Prism Launcher instead.
Is TLauncher legal? Not when you use it to play without buying Minecraft. Mojang's EULA only lets you download, install and play the game once you buy it, and Malwarebytes notes that using a cracked launcher is considered illegal in most regions.
Is TLauncher open source? No. Its site offers an installer and a .jar file but no source code, so nobody outside TLauncher Inc. can check what it does. Prism Launcher's full code is on GitHub under GPL 3.0.
Sources
All opened on 31 October 2026:
- Prism Launcher: home page, downloads for Windows, macOS and Linux, news, posts on 11.1.1, 11.1.0, 11.0.2 and 6.3, the Discord link alert and the fractureiser warning
- Prism Launcher on GitHub: security advisories GHSA-wxgx-8v36-mj2m, GHSA-gq28-qx55-mh2r and GHSA-g7mw-q872-w63w, release notes for 11.1.1 (including the signature block of its Windows installer), 11.1.0, 11.0.3, 11.0.0 and 7.0, pull requests #5034 and #5511, contributors and organization members
- Prism Launcher source code at 11.1.1: AccountListPage.cpp (offline accounts), MSAStep.cpp, MSADeviceCodeStep.cpp and MSALoginDialog.cpp (Microsoft sign-in), NewInstanceDialog.cpp (modpack sources), CustomPage.cpp (mod loaders), JavaSettingsWidget.cpp and Application.cpp (Java settings and download), packaging actions for Windows, macOS and Linux (code signing)
- Malwarebytes: PUP.Optional.TLauncher
- TLauncher, read in Internet Archive copies because tlauncher.org showed our server a Cloudflare challenge: home page (captured 31 October 2026), privacy policy and Premium page (captured 22 October 2026)
- Mojang: Minecraft EULA
- Minecraft Wiki: server.properties