Trust and security
The installer isn't code-signed, so this page explains what Roster does on your PC and how to check the file yourself.
The installer is unsigned
The installer has no Authenticode signature, so Windows lists it as coming from an unknown publisher.
Windows will warn you once
Roster has no code-signing certificate, so SmartScreen doesn't recognise it the first time you run it.
An EV certificate costs $300 to $500 a year and needs a registered business. Roster doesn't have one. Check the SHA-256 below if you want to be sure the file is ours.
If you would never run an unsigned installer, don't run Roster. The download page has every release.
Check your download
Every GitHub release lists the SHA-256 of the installer in its notes. It takes half a minute to compare.
- Download Roster-Setup-1.5.0.exe from the release page.
- In PowerShell, in the folder you saved it to, run:
Get-FileHash Roster-Setup-1.5.0.exe -Algorithm SHA256- Compare the result with the hash in the release notes. If they differ, don't install it, and tell us.
The release script also uploads the installer and app binary to VirusTotal when it can, and links the reports in the notes. A clean scan means no engine matches today. It doesn't prove the file is safe.
Signed updates
Each release carries an Ed25519 signature. The app checks it before it installs anything.
Next to every release is a signed manifest, RELEASES.sig.json. Before offering an update, Roster verifies the manifest against the public key built into the app. It then checks every package's name and SHA-256 against the manifest. The manifest also signs the version, so an old signed release can't be replayed as an update. A bad signature, a missing manifest or any mismatch refuses the update.
The signing key is kept offline. It isn't in CI and no GitHub runner can reach it. Someone who swapped a file on the update host would still need that key.
The public key
Ed25519, raw 32-byte key, base64
rT3X3UzExD5Iq0z+Yowb0JD+7iJ+6q33lJXcPzKcruo=Fingerprint: SHA-256 of those 32 bytes, lowercase hex
d5b4282aa2422965b0f53f7696570379f83d5532ebfa1bd06afe124f71322db3Verify a release yourself
Put a release's .nupkg files and its RELEASES.sig.json in one folder, then run:
node server/tools/sign-release.mjs --verify --releasesDir <folder> --publicKey <the base64 key above>It checks the signature and the SHA-256 of every package the manifest lists, and exits 0 only if all of it matches.
What Roster touches
It manages accounts and starts Roblox the normal way. It doesn't reach into the game.
On your PC, Roster:
Touches
- Roblox's web APIsroblox.com, over HTTPS
- Your vaultEncrypted, on this PC only
- Roblox's launcherHands it a sign-in ticket
- The game windowPosition, volume, and Roblox's own FPS cap setting
Never touches
- Roblox's memoryNothing written to it
- Game filesNothing patched or replaced
- Injected codeNo DLLs
- Our serversYour cookie is never sent to us
Data and network
Roster has no analytics, crash pings or ads. Everything stays on your PC except the four things listed below.
Your vault, refresh logs, audit log, account settings and window layouts are all local. Your master password exists only as a key derived in memory. Roster would still work with everything blocked except Roblox.
What leaves your PC
- RobloxThe refresh loop calls Roblox's web APIs for each account, the same hosts your browser uses. Roster never touches the game client's own sockets.
- GitHub ReleasesRoster checks for updates and downloads signed packages. They install on the next launch.
- Licence server (Plus only)Activation sends your code and a hash of your hardware to api.accountroster.com. The app then asks for a fresh signed licence once a day.
- Presence ping (Free)An anonymous ping to accountroster.com once per session and once per Roblox launch. It carries no payload and no identifier. Plus installs are counted by the licence check instead. The privacy policy has the detail.
Don't use the same account in Roster and somewhere else. Roblox rotates the .ROBLOSECURITY cookie whenever a session uses it. Signing in through a browser, a phone or another tool can sign out the copy in the vault until you sign in again.
The vault
One encrypted file at %LocalAppData%\Roster\vault.bin. It never leaves your PC.
- Windows DPAPIThe vault's master key is wrapped with DPAPI for your Windows user. Another user on the same PC can't unwrap it.
- Optional master passwordSet one and Roster derives a key with Argon2id (64 MB, 6 iterations, 2 lanes) and seals the master key with AES-256-GCM before DPAPI goes on top. Getting the key then takes your Windows account and the password.
- Per-account encryptionEach account's secrets are encrypted with AES-GCM under their own key, and the whole file carries an integrity check. Writes are atomic.
- Plaintext only in memoryCookies are decrypted for the length of one authenticated call and then cleared. They are never written in plain text and never logged.
Licence
Plus is tied to one PC at a time. Checks are local, with a daily refresh.
- One active PCActivating on a new PC moves the licence. The old PC drops to Free on its next check-in.
- Offline windowA subscription keeps working offline for up to 4 days after its last successful check-in. A lifetime licence gets 30 days. After that the PC runs as Free until it reconnects. The app warns you a day before.
- Signed and localThe licence is an Ed25519-signed token bound to your hardware hash. The app verifies it on your PC and keeps it DPAPI-encrypted.
Limits Roster can't bypass
Roster launches accounts and stores their cookies. It doesn't make them look like different people to Roblox.
- Shared IP addressEvery account you launch talks to Roblox from your connection. An IP-level limit, captcha or sanction can reach all of them.
- Shared hardware fingerprintRoblox's client reads hardware details, and every account on this PC shares them. A hardware-level sanction against one alt can reach the others.
- Roblox's own decisionsCaptchas, "I Agree" walls, age gates and moderation actions are unchanged. Plus auto-agree only accepts the mildest prompts, like terms re-accepts. Anything more serious is left for you.
- Anti-cheat and gameplayHyperion judges what happens inside the client. How you launched it doesn't excuse exploits or rule-breaking, and those can get an account banned.
Releases
What a release gives you, and what it doesn't promise.
Each release publishes the installer and the update packages on GitHub, with the installer's SHA-256 in the notes and a signed manifest for the packages. Dependencies are pinned to exact versions, and their licences are listed in THIRD_PARTY_LICENSES.md, which ships with the app.
It does promise
- Update integrity. Write access to the update host isn't enough. An attacker would also need the private signing key.
- Download integrity. Thirty seconds with Get-FileHash proves your installer is byte for byte what was published.
It doesn't promise
- No SmartScreen warning. It shows until Windows learns the file. Use More info, then Run anyway.
- That the binary matches source. Roster has no reproducible builds or attestation. The link between source and binary is the developer's word.
- Bug-free software. It is provided as is, under the EULA.
Report a problem
If you find a security issue, please tell us before making it public. We'll reply, fix it and credit you, unless you'd rather not be named.
- Emailsecurity@accountroster.com, read by one person, usually within 24 hours.
- GitHubFile a private security advisory. Please don't open a public issue.
- What to expectAcknowledged within 3 business days. First assessment within 7 days. Critical fixes aim for 14 days from triage, and the rest ship in the next release. We disclose publicly once a fix is out.