Privacy and security
Exactly what crosses the network, what is stored, where, and who can see a session.
Debugging tools see everything a game does, so here is exactly where that data goes.
What crosses the relay#
Everything the interface shows: remote calls and their arguments, HTTP requests and responses, instance names, script sources, console output. It has to — that is the data you asked to see, and it is being captured on your machine and displayed in your browser.
It crosses over TLS (wss://), so it is encrypted in transit.
What the relay stores#
Nothing.
Frames are forwarded byte for byte. The relay does not parse them — many are LZ4-compressed and base64'd, and reading them would mean decompressing something it has no reason to look at.
The only state it holds is, per live session:
- the room code
- which two sockets belong to it
- when they last spoke, so dead ones can be swept
No database, no log of frame contents, no disk writes. A room with nobody in it is deleted a minute later.
What your browser stores#
Captured sessions are written to IndexedDB on your own machine, so they survive a reload and you can come back to a capture later.
That means:
- Closing the tab does not lose your session
- Clearing site data for rbx.lol deletes it permanently
- It never leaves your machine — there is no account, no sync, no upload
Shared or public computers
Because captures persist locally, on a shared machine use a private window, or clear the session from the interface when you are done.
Who can see a session#
Anyone with the room code, and nobody else.
The code is ten characters from a 31-character alphabet — about 50 bits, which is not brute-forceable. But it is a shared secret, so anyone you send it to can join your room and watch the same traffic.
A room holds at most one executor and one browser. A second browser with the correct code replaces the first rather than joining alongside it, so you would notice.
What we can see#
Operationally: how many rooms are open, and that a socket connected. That is what the health endpoint reports and what the process logs.
Not: your room's contents, your game, your account, or anything inside a frame.
Running it yourself#
If you would rather not use a hosted relay at all, don't — the original local bridge still works, and the client can point at any WebSocket URL:
getgenv().NETBRIDGE_URL = "ws://localhost:9000/"
loadstring(game:HttpGet("https://rbx.lol/netbridge/client.lua"))()Then nothing touches the network beyond your own machine.
The honest caveats#
- Your executor sees everything anyway. NetBridge does not grant access it did not already have; it displays it.
- A relay operator could, in principle, log frames. This one does not, and the source is available so you can check. If that is not good enough for your threat model, run it locally — that option exists precisely for this reason.
- Roblox may consider executor use against its terms. That is between you and Roblox, and it is true of every tool in this category.