Free tool
Roblox backdoor scanner
Check a model, a place or a script for backdoors and hidden code before it goes in your game. Free, and it never leaves your computer.
Only have a script?
Your file or script stays on your computer: the check runs in your browser and nothing is uploaded.
What it looks for
In every script in the file, wherever it's hidden: inside parts, meshes and models, and in each file of a .zip.
Reaches for the Roblox login cookieUrgent
It reads .ROBLOSECURITY, the cookie that keeps an account signed in. An honest model never needs it.
Sends data to a Discord webhookUrgent
It sends data from your game to someone's Discord channel.
Runs text as codeUrgent
It runs text as code (loadstring, or code fetched with HttpGet), so what runs can change at any time.
Changes a script's environmentUrgent
It reads or changes a script's environment (getfenv / setfenv), a common way to hide what runs.
Text hidden as number codes
It spells out text as number codes, a way to hide what the code says.
Code pushed far to the right
It pushes code far off to the right of a line, where you won't see it unless you scroll.
Loads outside code by asset id
It loads a module from the Roblox library by its asset id, so whoever made that module can change what runs in your game at any time.
How it works
- Step 1
Drop the file
A model, a place, or a .zip of them, straight from your downloads or exported from Studio.
- Step 2
It's read on your computer
The scanner opens the file in your browser, the way Studio does, and reads every script in it.
- Step 3
See what it found
Each sign with the script it's in, the line, and what it means, so you can remove it before you press Play.
Questions
Is my file uploaded?
No. The scanner runs in your browser: your file is read on your computer and never sent to Forja or anyone else.
Does it find every backdoor?
No scanner can promise that. It finds the signs backdoors leave (outside code loaded by id, text run as code, hidden code, data sent away) in every script it reads. Read what it finds, and check by hand too.
Which files can it check?
Roblox models and places (.rbxm, .rbxl and their text versions .rbxmx and .rbxlx), .zip files with those inside, and .lua scripts. Files up to 200 MB.
Can I check just one script?
Yes. Press "Paste it here" under the file box and paste the code. It gets the same check, in your browser. Handy for a script someone sent you, or one you found online, before you put it in your game.
Is require() always bad?
No. Games load their own ModuleScripts with require all the time. The scanner only flags a require of an asset id, which runs code someone else can change at any time.
Where does this check come from?
It's the same check Forja runs on every Roblox file sellers upload. A listing with any of these signs waits for a Forja admin before it goes on sale.
Is it free?
Yes, with no account needed.
Guide
How to check a Roblox model for backdoors
What each sign means, what's normal, and how to remove one in Studio.
Read the guideChecked by Forja
Free assets with their scripts checked
Every Roblox file sold on Forja goes through this same check.
Browse free assets