What Is loadstring in Roblox? How Script Loaders Work

What loadstring(game:HttpGet(...))() actually does, why almost every Roblox script ships as a one-line loader, and how to tell a safe loader from a risky one.

If you've used an executor, you've pasted a line like this:

loadstring(game:HttpGet("https://example.com/script.lua"))()

It's how almost every script gets shared. Here's what that line actually does, why creators ship scripts this way, and what to check before you run one.

Reading the line from the inside out

There are three steps packed into one line.

  1. game:HttpGet(url) downloads the text at that URL and returns it as a string. Nothing runs yet. It's just source code sitting in memory.
  2. loadstring(source) compiles that string into a function. If the code has a syntax error, it returns nil plus an error message instead.
  3. The final () calls the function, which is the moment the script actually runs.

So the line means: download some code, compile it, run it. The script itself isn't in the line at all. It lives on a server, and the line just fetches it.

Why scripts ship as loaders

A one-line loader solves a few real problems for creators.

Updates reach everyone at once. When the creator fixes a bug, they change the file on their server. Everyone running the loader gets the fix the next time they execute it. Nobody has to re-download anything.

The real script stays off paste sites. If the full source were in the post, anyone could copy it, strip the credits and repost it. With a loader, what gets shared is a URL.

The server can decide who gets the script. This is the important one. Because the server sends the code, it can check something first: a key, a device, a ban list. That's what a key system is. We go through how they work in our key system guide.

The catch: a loader is only as private as what it returns

A plain loader doesn't protect anything on its own. If the URL returns readable source, anyone can open the URL in a browser, or print the string before it's compiled, and read the whole script.

That's why serious scripts combine three things:

  • A key check on the server, so the real script is only sent to players who are allowed to run it.
  • Obfuscation, so even the people who are allowed to run it can't easily read or edit it. Our post on protecting a script from being decompiled covers why.
  • Device locking, so one key can't be passed around a Discord server.

How to tell a safer loader from a risky one

Running a loadstring means running whatever that server sends, today and every day after. Before you paste one, a few checks help:

  • Where did you get it? A loader from the creator's own Discord or site is a different thing from one reposted in a random comment. Reposts are a common way to swap in a different URL.
  • What domain does it point to? Look at the URL itself. If it's a raw paste link from someone you've never heard of, that's a lot of trust to hand over.
  • Is it nested? Some loaders download another loader, which downloads another. Each hop is another server you're trusting.
  • Does the creator have a track record? A script with an active community and regular updates has more to lose from shipping something malicious.

None of this makes a loader safe, but it filters out the obvious traps.

If you're a creator: shipping your own loader

If you're publishing a script, the loader your players see should be short and boring, and all the logic should stay on your side. A good setup:

  1. Players run one loadstring that contains nothing except the fetch.
  2. Your server checks their key and hardware ID before sending anything.
  3. What it sends back is obfuscated, so a dump doesn't hand over your source.
  4. You can see every execution, and ban a key or device so anyone running it is kicked.

That's the setup LuaProtect gives you out of the box: you upload your script, it's obfuscated with a VM obfuscator, and players get a one-line loader that checks their key before your script starts. The free plan covers the obfuscator, key system and bans.

Quick reference

  • game:HttpGet(url) downloads the code as a string.
  • loadstring(source) compiles the string into a function.
  • () runs it.

One line, three steps, and all the trust in the server at the other end of the URL.