We never see your Roblox password
Signing in happens on roblox.com through Roblox's official OAuth 2.0 authorisation flow. You type your credentials into Roblox's own page, never into ours, and Roblox shows you which permissions you are granting before you accept. We only ever receive the access token Roblox hands out afterwards.
We will never ask for your Roblox password, your .ROBLOSECURITY cookie, an API key, or a 2-step code. If any page claiming to be rblxplugin asks you for one of those, it is not us – close it and tell us.
The permissions we ask for
| Roblox scope | What it is for |
|---|---|
openid, profile | Shows your username in the plugin so you can see which account is connected. |
asset:write | Uploads the images from your design into your own Roblox account as Decals. |
asset:read | Checks whether an upload finished and whether Roblox moderation approved it. |
That is the complete list. There is no scope for Robux, for your inventory, for group funds, for messages or for your games, and we could not use one if we wanted to. You can revoke access at any time – in the plugin with Disconnect, or in your Roblox account settings under Security → Authorised apps.
What we store, and for how long
- Your user ID, username and the Roblox tokens – needed to upload on your behalf. Deleted when you disconnect or when Roblox invalidates them.
- Your import code (6 characters) and the layout behind it – stored for 24 hours, then deleted automatically.
- A fingerprint (SHA-256) of each uploaded image plus the Roblox asset ID – so the same image is never uploaded twice.
Images pass through our server straight to Roblox; they end up in your Roblox account, not ours. Full details are in the privacy policy.
What this website does not do
- No cookies, no analytics, no tracking pixels, no ads.
- No third-party scripts or fonts – everything on this site is served from this domain.
- No downloads of .exe, .zip or installer files. The Figma plugin runs inside Figma, the Studio plugin is installed through Roblox Studio.
- No "free Robux", no giveaways, no generators, no crypto. We sell developer tools; that is all.
- Payments are handled entirely by Lemon Squeezy (our reseller and Merchant of Record). We never see or store card details.
The code that runs in your game
When you import a design, GUIHelper adds one LocalScript called GUIHelper next to your UI. It scales the layout and plays the animations you configured. We publish it in full so you – or anyone reviewing this site – can read it before trusting it:
Things you can check for yourself in that file: there is no HttpService, no require() of an external model, no loadstring, and no data collection of any kind. It only reads attributes on the UI objects that GUIHelper itself created.
How to verify who you are dealing with
- The only official domain is rblxplugin.com. Everything runs over HTTPS on Cloudflare.
- The Roblox sign-in page you land on must be on roblox.com – check the address bar before you accept.
- Operator details are in the legal notice.
- rblxplugin is an independent developer. It is not affiliated with, endorsed by or sponsored by Roblox Corporation or Figma, Inc.
Found a security problem? Or think this site is being abused?
Please tell us – we would much rather hear about it early. Write to the address in our legal notice with as much detail as you can. We answer security reports first, and we will not take legal action against anyone who reports a problem in good faith without breaking other people's data.
Machine-readable contact: /.well-known/security.txt