What is a loadstring?
A loadstring is one line that downloads a script from a link and runs it. Most scripts are shared this way: 1,745 of the 2,071 scripts on RoScripts load their code from at least one other address.
What the line means
This is the line nearly every script page gives you to copy:
loadstring(game:HttpGet("https://example.com/script.lua"))()
It is three steps, read from the inside out.
| Part | What it does |
|---|---|
game:HttpGet("…") | Downloads the text at that address. |
loadstring(…) | Turns that text into code the game can run. |
() | Runs it. |
So the line you copy isn't the script. It is the address of the script, with an instruction to fetch it and run it.
Why scripts are shared this way
A creator who posts the full code has to post it again after every fix. With a loadstring the link stays the same and the creator changes the file behind it, so everyone who runs the line gets the newest version. It also lets a creator keep the code on a server that only hands it over after a key is accepted.
How many files one line loads
The file a loadstring fetches often fetches more: a menu library, a list of games, the part for the game you are in. Scriptsight follows each of these when it checks a script.
The code behind a link can change
This is the part that matters for safety. A line that ran a harmless script last week runs whatever is at the link today. Of the 4,639 files that scripts on RoScripts load, 330 changed in the 30 days to 14 November 2026. They sit behind 297 scripts.
Nearly all of those changes are updates. A few aren't: a script can be posted clean and have a stealer swapped in once people trust it. For that reason RoScripts fetches each file again on a schedule and runs the script again when one changes.
Reading one before you run it
Look at where the link points
The address inside the quotes names the site that will supply the code: GitHub, a paste site or the creator's own.
Open the link in a browser
You see the text the line would run. If it is readable, look near the top for another account's name or a Discord webhook address.
Expect it to be scrambled often
About half the scripts on RoScripts are obfuscated or packed, and reading those tells you little. A check that runs the script sees what reading can't.
Copy the whole line. A loadstring with a quote or a bracket missing does nothing at all. Why a script isn't working shows what a broken one looks like.
Why loadstring is off in Roblox Studio
In a game's own code, loadstring is switched off unless the developer turns on a setting called LoadStringEnabled, and Roblox's documentation advises leaving it off, because running downloaded text is a risk to a game. Executors bring their own loadstring and HttpGet, which is why the line works there and not in a normal game script.
Questions
Is a loadstring dangerous?
The line itself does one thing: it runs whatever the link returns. Whether that is safe depends on the code at the link, and that code can be changed later by whoever controls the link.
What is HttpGet?
A function that downloads the text at a web address. In a loadstring it fetches the script's code so loadstring can run it.
Why is a script only one line long?
Because the line is a pointer. The script's real code sits on the creator's own site, on GitHub or on a paste site, and the line downloads it each time.