Account Manager

Add your real Roblox accounts to Quark, keep their sessions encrypted on your own machine, and launch one or many of them straight into a game.

The Account Manager tab lives inside the Quark Windows desktop app. It stores the accounts you sign in with, launches them into a game by id or link, and can run several Roblox clients side by side with Multi-Roblox. Accounts are added through the account's .ROBLOSECURITY cookie rather than a username and password, and every stored cookie is encrypted at rest with Windows DPAPI so it never sits on disk in plain text.

Why cookie auth instead of a password

Quark authenticates each account with its Roblox session cookie, the value Roblox itself calls .ROBLOSECURITY. Quark never asks for, sees, or stores your Roblox password. There are a few concrete reasons this is the right approach:

• Nothing to leak. Because Quark holds a session token and not your password, the credential that unlocks your whole account never touches the app.
• It survives 2-Step Verification. A password login would hit 2SV, email codes, and CAPTCHA challenges. A valid session cookie is already past all of that, so launching is instant.
• You stay in control. A cookie can be revoked at any time by signing the account out everywhere from Roblox's own security settings, which immediately invalidates the copy Quark holds.

Finding your .ROBLOSECURITY cookie

The cookie is set by Roblox in your browser when you are logged in. You read it out once and paste it into Quark.

DPAPI encryption at rest

Once an account is added, Quark encrypts its cookie with the Windows Data Protection API (DPAPI) before writing anything to disk. DPAPI ties the encryption to your Windows user account, which means:

• The stored cookie is never readable as plain text on disk.
• Only your logged-in Windows user can decrypt it. Another user on the same PC, or someone who copies the raw Quark data files to a different machine, cannot decrypt them.
• Quark decrypts a cookie in memory only at the moment it needs to launch that account.

Launching into a game

From the Account Manager you can send any stored account directly into a Roblox experience. Quark accepts either the game (place) id or a full Roblox game link:

Game id:   126884695634066
Game link: https://www.roblox.com/games/126884695634066/Some-Game-Name

Pick the account, provide the id or link, and launch. Quark uses the account's session to open the Roblox client already joined into that place, so there is no manual login step in the client itself.

Multi-Roblox: running several clients at once

Multi-Roblox lets you run more than one Roblox client on the same PC at the same time, each signed in as a different stored account. By default Windows and Roblox allow only a single client instance, and Multi-Roblox is what removes that single-instance limit so you can launch a second, a third, and beyond in parallel.

• Select multiple accounts and launch them together.
• Each client runs as its own account and its own window.
• Your practical ceiling is your hardware. Every extra Roblox client adds CPU, memory, and GPU load, so how many you can run smoothly comes down to your machine.

Account limits: monthly vs lifetime

How many accounts you can store depends on your Quark plan.

Monthly-key users are capped at 5 accounts. Lifetime and staff accounts have no cap. Upgrading from a monthly to a lifetime key lifts the limit.

Safety notes

• Only add accounts you own or are authorized to use. The cookie grants full access to the account.
• Never share a .ROBLOSECURITY value. The warning baked into the cookie is there for a reason. Sharing it is the same as handing over the account.
• Revoking is easy. If a cookie is ever exposed, sign the account out of all sessions from Roblox security settings. That invalidates every existing cookie, including the one Quark stored, and you can re-add the account with a fresh one.
• DPAPI is per-user, per-machine. Your stored accounts do not travel. Moving to a new PC or a new Windows user means adding the accounts again there.
• Keep your PC secure. DPAPI cannot defend against software running as your own Windows user, so a locked, malware-free machine is what keeps the stored sessions safe.