Roblox Scripting Glossary

The platform and engine. Both a place where games are hosted and the runtime they run on. When someone says "Roblox" casually they often mean the client app on their machine.

The languages Roblox games are written in. Roblox forked Lua into Luau — a faster, gradually-typed variant with extras like compound assignment operators and generalised iteration. In practice most people still call it "Lua".

A piece of Luau code attached to an object in a Roblox game. Scripts come in three flavours: Server scripts (run on the game server), LocalScripts (run on a player's client), and ModuleScripts (libraries that other scripts can require).

A small one-line snippet that downloads and runs a larger script over HTTP. Typically looks like loadstring(game:HttpGet("…"))(). Loadstrings are popular because they let you update the underlying script without having the user copy a new snippet every time.

The actual code the loadstring fetches. A loader usually does setup work — checks the user's key or licence, picks the right script for the current game, then loads it.

Software outside Roblox that can run Luau code in the context of a game. Different executors trade off compatibility, speed, and stability. Lists of "supported executors" you see on script sites refer to which ones their scripts have been tested against.

The step where an executor connects itself to the running Roblox process so it can run scripts inside it. Most executors have an "Inject" or "Attach" button as the first thing you press after launching them.

A gate users go through to unlock a script. Usually it involves visiting a website, completing a short flow (timer, captcha, ad-network task), then receiving a key that the loader checks against a server.

A widely-used third-party service that handles obfuscation, key issuance, and licence checks on behalf of script authors. When a script "uses Luarmor", the key check and the encrypted payload both go through their infrastructure.

Lists of accounts, hardware fingerprints, or executors that are allowed (whitelist) or denied (blacklist) by a script. Premium scripts are often whitelisted by purchase, and banned users land on a blacklist.

Short for "hardware ID". A fingerprint derived from characteristics of the user's machine, used by key systems to bind a key to one device so it can't be shared.

The objects games use to send messages between client and server. RemoteEvents are fire-and-forget, RemoteFunctions return a value. Because almost every gameplay action goes through one of these, they're the main target of script-level inspection.

A long-time Roblox setting (now mandatory) where the client cannot directly change other players or the world. Anything meaningful has to go through a Remote, which the server decides whether to accept. This is the foundation of server-side anti-cheat.

A piece of script-side code that intercepts an existing function so it can change its behaviour, log it, or block it. Hooks are how features like "remote spy" or "auto-block" are typically implemented.

A Lua-level mechanism for calling methods on userdata. Roblox uses namecalls under the hood when you write something like part:Destroy(). Scripts often hook namecalls to monitor or filter calls to built-in Roblox APIs.

A table attached to another table that customises what happens on common operations (lookup, addition, comparison, etc.). They're the foundation of OOP in Lua and also where many advanced script behaviours live.

A tool that logs every RemoteEvent / RemoteFunction call in a game in real time, so you can see what the client sends. Used by script authors to understand a game's protocol when building features.

In-game UI tools that mirror Roblox Studio's Explorer pane — they let you browse the workspace, services, and ReplicatedStorage of a running game. Mostly used for inspection, not modification.

A tool that turns Roblox bytecode back into readable Luau. Used to understand how a game's scripts work when you don't have the source.

Roblox's client-side protection layer. It checks the integrity of the Roblox process, watches for unauthorised attachments, and raises the cost of running unsanctioned code inside the client. Often still referred to as "Byfron" after the company Roblox acquired to build it.

The broad term for any check a game's server does on client-sent input. The strength of a game's anti-cheat usually correlates directly with how thorough this is.

When an anti-cheat (Roblox's or a game's) flags a legitimate player. Usually rare in practice, but worth knowing the term because it's what every false-ban appeal centres on.