Three different locks, not one
A join password is a single shared word everyone types before the game finishes connecting them. Anyone who has the word gets in, which means it is only as private as the last person you told. A whitelist checks each player's account or Steam ID against a list you control, one name at a time, with no shared secret to leak. An admin password is neither of those — it does not gate the front door, it hands out server-owner powers (kicking, banning, changing settings, loading a different save) to whoever types it correctly after they are already in. Mixing these up is the most common setup mistake: a join password does nothing once a player is already in, and an admin password left at a default value hands out ownership of the whole world.
Minecraft: no join password, use the whitelist
Vanilla Minecraft has no server.properties entry for a join password at all. The setting you actually want is white-list, documented as controlling "whether the whitelist is enabled. With a whitelist enabled, users not on the whitelist cannot connect." Pair it with enforce-whitelist, which kicks players who fall off the list "after the server reloads the whitelist file" instead of waiting for their next join. In-game, the /whitelist command does the same work without editing files: whitelist add <player>, whitelist remove <player>, whitelist list, and whitelist on / whitelist off to toggle it. Operators pass the whitelist check on their own, no adding required. Also worth setting: online-mode, which decides "whether to only allow players verified with the Minecraft account database to join" — leave it on and a whitelist entry actually matches a real account; turn it off for a cracked-client server and anyone can claim any name, whitelist or not. If your group is new to running one at all, our guide to setting up a Minecraft server for friends covers the rest of first-time setup, and current plans are on the Minecraft hosting page.
Valheim: the -password launch parameter
Valheim's dedicated server binary takes a password directly on the command line: -password "Secret", alongside -name, -world, -port and -public. When a client tries to connect, the server checks Steam IDs, its ban and permit lists, and the password together before letting anyone in — so the password is one of several gates, not the only one. Iron Gate lists the three permission files, adminlist.txt, bannedlist.txt and permittedlist.txt, in the default save path, and -savedir moves that whole folder if you keep saves elsewhere. Set -public 0 if you also want the server left out of the in-game browser entirely, joinable only by direct IP. To whitelist a player instead of sharing a password, add one Platform User ID per line — in the [Platform]_[User ID] form, found in the server log or the in-game F2 screen — to permittedlist.txt in the save path; Iron Gate notes that adding anyone to the permitted list bans everyone else from the server. Current plans are on the Valheim hosting page.
Palworld: ServerPassword and AdminPassword in PalWorldSettings.ini
Palworld keeps both passwords in the same file, PalWorldSettings.ini — under Pal\Saved\Config\WindowsServer\ on Windows and Pal/Saved/Config/LinuxServer/ on Linux, per Pocketpair's server guide. ServerPassword is the "password required to log in to the server," and it is optional — leave it blank and anyone can join. AdminPassword is a second, separate value — Pocketpair describes it as the "password used to obtain administrative privileges on the server." Setting it in the file is not enough by itself: a player also has to type /AdminPassword YourPassword in chat before the server treats them as an admin; the commands page describes the command as a way to "obtain administrative privileges using a password." The two settings are independent — require a join password with no admin password, or hand out admin rights on an otherwise open server, though neither is a sensible default. Current plans are on the Palworld hosting page.
Terraria and 7 Days to Die: a password line in the server config
Terraria takes a password the same way Valheim does, as a launch flag — -pass <password> or -password <password> — or as a line in serverconfig.txt: the shipped example file includes it commented out as #password=p@55w0rd, so you remove the leading # and set your own value. The same file's secure=1 line, described as adding "cheat protection," is a separate setting worth turning on alongside a password rather than instead of one. Current plans are on the Terraria hosting page.
7 Days to Die stores its join password in serverconfig.xml as <property name="ServerPassword" value=""/>, documented as "password to gain entry to the server" and blank by default. That file carries no whitelist of its own — whitelisting lives in serveradmin.xml instead (named by the AdminFileName property), the same file that holds the admin list. Putting any entry inside its <whitelist> section turns on whitelist-only mode, where, as the wiki puts it, "nobody can join that isn't in the whitelist or admins." The related ServerVisibility setting controls whether the server shows up in the browser at all — public, friends-only, or unlisted — independent of whether a password or a whitelist is set. Current plans are on the 7 Days to Die hosting page.
Project Zomboid: a shared password and an account whitelist
Project Zomboid's servertest.ini carries a join password and a whitelist toggle that work differently. Password= is "clients must know this password to join the server," and it is explicitly "ignored when hosting a server via the Host button" — it only applies to a proper dedicated server. Open=true is the whitelist switch, meaning "clients may join without already having an account in the whitelist. If set to false, administrators must manually create username/password combos" — so with Open=false, every player needs their own account rather than one shared password. A related setting, DropOffWhiteListAfterDeath, removes a player's whitelist account after their character dies, stopping a fresh one on an Open=false server. The remote-console password, RCONPassword, is a third, separate credential again — it authenticates external admin tools, not players. Current plans are on the Project Zomboid hosting page.
Satisfactory: two passwords, set from inside the game
Satisfactory does not put a password in a config file you edit before launch. Claiming the server is where you set the Admin Password: start the game, add the server in the in-game Server Manager, then — in the wiki's words — "set a name for the server, then set the administrator password" as part of that step, not afterward. The Admin Password limits "Administrator privileges (such as Save Game loading, Server Options and New Game creation) to a certain set of players." The separate player password is added afterward, from the Server Settings tab in-game: it "limits who can connect to the server and see information about the ongoing game session," is off by default, and switches on with the "Change Password" control next to player-password protection. If you lose the Admin Password, delete the server's ServerSettings.PORT.sav file — for example ServerSettings.7777.sav — which sits just above the server's savegame directory, not inside it. Doing this resets the server name, the player password, the auto-load session name and the certificate together; there is no separate reset command. Current plans are on the Satisfactory hosting page.
Sharing a password safely, and what it does not stop
Post a join password in a public Discord server or a public server-browser description and it stops being a password. Send it in a direct message, a private channel limited to the people invited, or read it out over voice chat — anywhere it cannot be screenshotted and reposted publicly. If a password does leak, changing it is a config edit and a restart away in every game above except Satisfactory, where you change it live from the in-game Server Manager instead — and it is worth doing the moment you suspect it has spread further than you meant.
None of these settings substitutes for the others, and none does more than its own job. A join password keeps out people who were never told it, nothing more — once someone is connected, only a whitelist, an access level or an admin's own moderation stops them from causing trouble in-world. An admin password that matches your join password, or that you handed to someone you do not fully trust, is not really separating those two jobs at all.