Can a script steal from me just by running it?

It can try. From the moment it runs, a script can act as your character and send web requests, which is enough to give away items or send your details to someone else. That is why you read the code first, and do not run a script you cannot check.

Does obfuscated code mean a script is a stealer?

No. Many honest creators obfuscate their code to protect it. It only means you cannot check it yourself, so you are trusting the author and whoever reviewed it. ScriptBlox reviewers can run obfuscated code through a deobfuscation tool before they decide. How review works.

Who do I tell about a stealer?

Report the script on the site where you found it, so it can be taken down for everyone. For your Roblox account itself, contact Roblox Support.

Guide

How to tell if a Roblox script steals your account

Last updated Nov 9, 2026

You can usually tell by what the script does with your data. A script that steals from you has to send something out or make your account do something. The signs are web requests to Discord webhooks or unknown websites, code that mentions your cookie or password, trades or gifts it starts on its own, and code hidden so you cannot read it.

What does a Roblox stealer try to take?

Your session cookie. Roblox keeps you signed in with a cookie called .ROBLOSECURITY. Anyone with a copy of it can use your signed-in session without knowing your password, so it is the main target.
Your items and Robux. Some scripts trade, gift or sell your in-game items and limiteds while you think they are doing something else.
Your executor's workspace folder. Executors give scripts a folder to save files in, and some scripts upload the whole folder to their author. That folder can hold saved keys and settings from your other scripts.
Personal details, such as your user ID, IP address or hardware ID. ScriptBlox's rules say a script that logs any of these must say so in its post.

ScriptBlox's upload rules do not allow scripts that steal items, Robux, limiteds, cookies, logins or the workspace folder.

What are the warning signs in the code?

A Discord webhook. That is an address that starts with https://discord.com/api/webhooks/ (or the older discordapp.com). Anyone who has a webhook address can post messages into a Discord channel, which makes it an easy place to send stolen data. A script that has nothing to do with Discord has no reason to contain one.
Web requests to addresses you do not recognize, or to a bare IP address made of numbers instead of a website name.
Anything that mentions ROBLOSECURITY, cookies or passwords, or asks you to type or paste them. No script needs them.
Code that is unreadable on purpose, called obfuscation. Honest creators use it too, for example to protect a paid script, so it is not proof on its own. But it means you cannot check what the script does.
A loader such as loadstring(game:HttpGet("https://..."))() that points at a website the author controls. The code behind it can be switched to a stealer after people start using it.

One of these on its own is not proof. It is a reason to look closer, or to not run the script at all.

What tricks do stealers use outside the script?

Fake executors and downloads. Security companies including Bitdefender and ESET have reported fake executor installers that carry malware which steals browser data, saved passwords and cookies. That kind of malware can read the cookie your browser saved for roblox.com. See where to download executors safely.
Free Robux, free items or item duplication. These are the most common promises scam scripts make.
Instructions to paste code into your browser's developer console, or to drag a link into your bookmarks bar. Never do either because someone told you to.
A script description that tells you to turn off your antivirus or run a program outside Roblox. A Roblox script never needs either.

What should you do if a script stole your account?

If you downloaded and ran a file, scan your computer with a trusted antivirus first, or use a different device for the next steps. Otherwise the same malware can take your new password.
Change your Roblox password.
In your Roblox settings, under Security, log out of all other sessions. This ends the sessions that use your stolen cookie.
Turn on 2-Step Verification.
If you cannot get back in, contact Roblox Support.
Report the script where you found it. On ScriptBlox, use the Report button on the script page, and our team will take it down if it breaks the rules.

If you are under 18, tell a parent or another adult you trust as well. Losing an account is not something you have to sort out alone.

Questions

Can a script steal from me just by running it?: It can try. From the moment it runs, a script can act as your character and send web requests, which is enough to give away items or send your details to someone else. That is why you read the code first, and do not run a script you cannot check.
Does obfuscated code mean a script is a stealer?: No. Many honest creators obfuscate their code to protect it. It only means you cannot check it yourself, so you are trusting the author and whoever reviewed it. ScriptBlox reviewers can run obfuscated code through a deobfuscation tool before they decide. How review works.
Who do I tell about a stealer?: Report the script on the site where you found it, so it can be taken down for everyone. For your Roblox account itself, contact Roblox Support.