No surprises buried in a settings page. The four things below are the core product; the rest are quality-of-life features that earn their keep once you're running more than a couple of accounts.
Every account's .ROBLOSECURITY cookie is wrapped with Windows DPAPI under your user account, then optionally re-wrapped with an Argon2id-derived key from a master password. The plaintext only exists in process memory, and only for the milliseconds it takes to make one authenticated call.
Roblox enforces a single-instance mutex. Roster bypasses it at the OS level — the same trick a clean process tree would do — without injecting a DLL, patching the binary, or shipping anti-cheat-flavoured code. The launcher places each window for you and applies a per-instance throttle so four clients don't melt the machine.
A jittered heartbeat fires once per account every ~5 minutes (±20%). The response stream is sniffed for any Set-Cookie: .ROBLOSECURITY Roblox emits, and the new value is wrapped and written to the vault before the call returns. Stale accounts go to the front of the queue.
Roblox occasionally puts an account behind a blocking "I Agree" modal (cosmetic warnings, ToS re-accepts) that prevents the account from joining games until a human clicks the button. Roster detects these during the refresh loop and acknowledges the harmless ones for you, per account, on a toggle you control. Nothing is ever sent on your behalf without your consent.
Quality-of-life features that earn their keep once you're running more than a couple of accounts.
Each account card shows what game it's in, what server, and how long it's been there.
Aggregates Robux balance, RAP, and limited-item counts across every account in the vault.
Per-account session log: how long each alt has been in a game, per place, with weekly and lifetime totals. Local-only.
Tag each account with a private nickname and free-text notes. Survives export/import.
Apply throttle, tags, or alias prefixes across a selection of accounts in one transactional pass. Partial failures roll back.
Group accounts ("Mains", "Storage", "Group holders") for one-click multi-launch and bulk actions.
Save named tilings and snap to them on launch. Multi-monitor aware.
Global cycle-focus, mute-background, and snap-to-layout shortcuts. Work while the launcher is minimised.
If a Roblox instance dies mid-session, the launcher offers a one-click relaunch into the same place and server.
Save private-server links per account or per game. Launch into them directly from the card.
Search Roblox's catalog from inside the launcher, queue a place for any subset of alts, or join whatever a friend is currently playing.
Sweeps the %LocalAppData%\Roblox caches on demand so a misbehaving install doesn't quietly grow to gigabytes.
A short list of features people ask for and won't get. The reason in each case is "it's the kind of code that quietly burns your accounts."
Roster never loads code into the Roblox client. Anti-cheat doesn't see us because there's nothing to see.
No auto-clickers, no scripted gameplay, no farming bots. The refresh loop talks to Roblox's web API the same way the official site does.
Zero analytics, zero crash pings. We don't know how many accounts you have or which games you play.
We looked at per-account proxy routing for v1 and dropped it. There is no current plan to revisit it. Bring a different tool if you need this. More on what Roster can't bypass →
Your vault stays on your machine. Exports are encrypted single-file blobs that you move yourself.
The mutex bypass is Windows-specific.