Connecting a game
Open the page, copy one line, paste it in your executor.
Open the interface
Go to rbx.lol/debugger. It generates a room code and a session key for you.
Copy the loadstring
The page shows a one-line script with your room code and session key already in it:
loadstring(game:HttpGet("https://rbx.lol/netbridge/client.lua?room=ABCD234XYZ"))("<session key>")The key is the argument at the end, not part of the URL, so it is never sent to the server the client is downloaded from or to the relay.
Run it in your executor
Paste, execute. The client connects outward and joins your room.
Watch the page go live
The status flips to Connected and the tabs start filling. Capture toggles start off, so turn on the stream you want.
The room code and the session key#
The room code is ten characters from a 31-character alphabet, about 50 bits, so it is not guessable. It decides who can be in the room: anyone with it can watch the traffic your game is capturing.
The session key decides who can command the game. Every command the page sends (run code, read a property, fire a remote) is signed with it, and the client checks the signature before it does anything. A command without a valid signature, one replayed from earlier, or one signed for a previous connection is refused. Someone with only the room code can watch but cannot make your game do anything.
Do not paste either publicly
Treat both like passwords. If you have shared one by accident, press New room code in the Connection panel: the game attached to the old room is told to stop, and a new code and key are made. Run the new line.
The alphabet leaves out 0/O and 1/I/L, so a code can be read aloud or
typed by hand without ambiguity. Privacy and
security covers what travels through
the room and what does not.
Permissions#
The debugger starts with full control. Browsing the Explorer, properties, sources and captures always works; anything that changes the game has its own switch under Connection → Permissions, so you can turn any of them off, or press Read only to turn them all off:
| Switch | Covers |
|---|---|
| Run Luau | The editor's Run, and the assistant's run tool |
| Fire remotes | Firing and invoking remotes; firing signals, prompts and click detectors |
| HTTP replay & mocks | Re-sending captured requests; mocked responses |
| Modify the game | Properties, attributes, destroy/reparent/clone/teleport, upvalues and constants, fast flags, blocking remotes, saving the place |
Full control turns all four back on and asks for a second click first. The switches are this browser's, remembered across reloads, and they bind the assistant too.
Ending a session#
End session in the Connection panel stops the debugger in the game: it removes its hooks, closes its socket and does not reconnect. Running the loadstring again starts a new session.
Reconnecting#
Re-running the loadstring is safe. The new client takes the room's game slot and the old socket is closed, so a stale connection after a game rejoin costs you nothing. Each connection gets a new nonce, so commands signed for the old one are refused by the new one. The page keeps your room code across reloads, so refreshing the tab does not force a re-inject.
More than twelve client connections to one room inside ten seconds and the relay turns the newest one away. Wait a few seconds and run the loadstring again.
Connection states#
The panel above the app reports one of these:
| State | Meaning |
|---|---|
| Starting | Setting up a room |
| Connecting | Reaching the relay |
| Waiting for your game | The page is in the room; the executor has not joined |
| Connected | The game is attached |
| Disconnected | Lost the relay, or another tab took over this room. Reconnects on its own |
| Connection failed | Could not reach the relay |
If nothing arrives#
- Did the script error in your executor? Check its console. A missing
WebSocket.connectis reported explicitly. - Does the Connection panel say the client is older, or took no key? Copy
the line again and run it. A loadstring from before session keys (ending in
)()) connects but takes no commands. - Is capture switched on? Remote Spy and HTTP Traffic both start off, so connecting does not immediately flood you.
- Is the game actually firing remotes? Move your character, open a menu. Some games are quiet at the main screen.
- Does your executor block outbound WebSockets? Rare, but a few sandbox the API.