FAQ & Troubleshooting

Fast answers to the questions that come up most often on Quark v2 — getting access, Discord verification, tiers and the free invite model, payment, the Obfuscator, the Account Generator, and running a key system for your own script.

One rule underpins almost everything below: the website is the single source of truth. The database and API live at quarkexploits.com, and the Discord bot and the buyer's loader are both clients of it. There is no desktop app to install — Quark runs entirely in your browser plus Discord. If something looks out of sync, confirm what the website shows first, then check Discord.

How do I get access?

Everything happens at quarkexploits.com/login. You sign in one of two ways, then verify Discord:

Activate a key — paste a Quark key (QRK-XXXXX-XXXXX-XXXXX). It is checked against the live license table, so a revoked or expired key is refused here. On first activation you create a username and password so you can sign in without retyping the key next time.

Username & password — once you have created a login, use it directly on later visits.

Verify Discord. The whole client area is gated behind Discord verification. Click Link Discord, approve the OAuth prompt in the new tab, and you're in.

Full walkthrough on the Sign in & Setup page.

Why is Discord verification required?

Your tier is read from the roles you hold in the Quark Discord server, and the website cannot see those roles on its own. Verification uses Discord's standard OAuth2 with two scopes — identify and guilds.members.read — so Quark can read your identity and your server roles, and nothing else. It never sees your password or your DMs. The link opens in a new tab.

Your tier is re-checked at generate-time, so if your roles change — you subscribe, upgrade, or a sub lapses — access updates on your next action without re-linking. No tier yet is fine: everyone starts on the free, invite-based tier. See Discord Link & Tiers.

What are the tiers, and how does the free invite model work?

The Obfuscator and the Account Generator both have a free tier that runs on invites, and the Account Generator adds three paid tiers on top. The free model is the same everywhere: 1 verified invite = 1 credit.

Enter the Discord @username you are going to invite.

They must join within 5 minutes and pass the anti-alt check — the account has to be at least 7 days old and have a real avatar.

The Discord bot verifies the join and grants your credit: one free obfuscation, or one free account draw.

Tier	Generator rate	Daily cap	Perks
Free	1 / verified invite	—	1 invite = 1 account (also 1 free obfuscation)
Basic · $5.99/mo	5 / 10 min	50	Fresh accounts
Premium · $12.99/mo	5 / min	200	Aged-account perk
Dominus · $29.99/mo	1 / 5 sec	600	Aged perk · priority queue · API + webhook

Rate limits are a sliding window (Basic is at most 5 claims in any 10-minute stretch, and so on) on top of a hard daily cap that resets at 00:00 UTC. Paid Obfuscator use is unlimited — the invite model only applies to the free tier. See Account Generator and Discord Link & Tiers.

How do I pay, and how does a tier activate?

Tiers are sold through the Discord. Open a purchase panel or ticket, and payment is confirmed manually in a private purchase ticket. The moment it confirms, the bot applies your tier role and the website reads the updated tier on your next check — no re-link needed.

Payment methods: Card, Crypto, PayPal, and Robux.
Platform license (QRK key): sold monthly or lifetime, plus six staff ranks (Helper, Mod, Admin, Head Admin, Manager, Owner). Managed by staff via the bot's /license commands or on the website.

Never share your key, password, or a Roblox .ROBLOSECURITY cookie in a public channel. All payment and sensitive support is handled inside a private ticket.

The Obfuscator

The Obfuscator runs server-side behind your license: paste Luau, pick a tier, and copy or download the protected build. It is behavior-preserving — the output runs bit-for-bit like your source. The free tier is 1 verified invite = 1 obfuscation; paid tiers are unlimited. Every run is saved to your History tab.

Tier	Representation	What it adds
Standard	Source (Luau)	ChaCha20 encryption of your source
Strong	Source (Luau)	Standard + additional nesting layers
Maximum	Source (Luau)	Strong + control-flow flattening
Hyper	Source (Luau)	Maximum + ciphertext fragmentation (strongest source tier)
Quantum	Custom VM / opcodes	Compiles to a per-build VM and opcode set; hard-gated and verified in real Luau

Every build is fingerprinted into a recovery vault, so staff can deobfuscate or recover any Quark-made build if you ever need it. Deobfuscation is staff/owner only — there is no self-serve reverse tool. Deep dive on the Obfuscator & Tiers page.

Is my obfuscated script safe?

The honest answer: nothing running inside an executor is truly unbreakable, and Quark does not pretend otherwise. The source-based tiers — Standard, Strong, Maximum, and Hyper — use ChaCha20 encryption, control-flow flattening, and ciphertext fragmentation. Hyper is the strongest source tier. But any source-based obfuscation can eventually be dumped by a determined attacker who hooks load() and peels the layers back to readable source. That is a fundamental limit of source-based protection, not a flaw specific to Quark.

The Quantum tier is different in kind. It compiles your script to a per-build VM and opcode set, so an attacker who dumps the output gets opcode numbers, not readable Luau. That is the real defense against the dump attack. Quantum is hard-gated: if it cannot guarantee a construct, it refuses and falls back to Hyper, and every output is verified by running it in a real Luau VM before it ships. All tiers execute 100% correctly — Quantum raises the bar from “peel the layers” to “reverse-engineer a custom VM.”

The Account Generator

The Account Generator draws a random Roblox account from a shared pool — the same pool the Discord bot draws from. Each account is claimed atomically, so the same one is never handed out twice across the site and the bot. When you generate one it reveals the username, password, .ROBLOSECURITY cookie, user id, profile, and avatar, and saves it to your History tab.

You never choose which account you get — every draw is random. Rate and daily caps come from your tier (see the table above); the free tier spends invite credits. Full details on the Account Generator page.

Key systems & the loader (for script creators)

A key system lets you sell your own Roblox script safely. You create one in the client area, get a raw loader id and a one-time API secret, and manage license keys yourself — create, revoke, HWID-lock, and set expiry — with Discord webhook logging on every execution. Your buyers run a small Lua loader that sends their key + HWID and receives your protected, HWID-locked payload. See Create a Key System, The Loader & Delivery, and Licenses & HWID.

The loader a buyer pastes into their executor is just two lines:

script_key = "THEIR-LICENSE-KEY"
loadstring(game:HttpGet("https://quarkexploits.com/raw/YOUR-ID.lua"))()

The stub reads the global script_key, collects HWID plus session info, and POSTs to /api/v1/loader/auth. The server validates the key and HWID before it returns the protected script. Most buyer-side problems surface as one of the errors below.

Error	What it means	How to fix it
`invalid-key`	The `script_key` in the loader does not match any license on this key system, or the key belongs to a different key system.	Check for typos, stray spaces, or missing quotes. Confirm the license exists and is `active`, and that the buyer is using the loader URL for the correct key system.
`hwid-mismatch`	The key is already bound to one machine and is now being run from a different HWID — the anti key-sharing check working as designed.	If the buyer legitimately changed or reset their PC, reset the HWID (see below). If you did not expect a second machine, the key may be shared — investigate before resetting.
`expired`	The license reached its expiry date, or its status is no longer `active` (paused, banned, or expired).	Renew or re-activate the license from the dashboard. A license with no expiry is lifetime and should never report this — if it does, check the status field.
nothing happens	The buyer pasted the loadstring line but never set `script_key`. The stub aborts immediately when the global is missing.	Make sure the `script_key = "..."` line sits above the loadstring, with the key assigned as a string to a global named exactly `script_key`.

How do I reset a buyer's HWID?

HWID binds to the first machine that executes the key. To move a key to a new machine you clear that binding so the next run rebinds fresh. There are two ways:

From Discord. The buyer runs /reset. This command has a cooldown to stop abuse, so it may refuse if used too recently. This is the self-service path.

From the dashboard. Open the license on the website and reset its HWID there. This has no cooldown and is the right tool when you are helping a buyer directly or overriding a cooldown.

After a reset, the very next execution binds the key to whatever machine runs it — so make sure the buyer runs it on the machine they intend to keep using.

My key-system bot is offline, or its commands are missing

A key system's bot is a Node process you host yourself, one per key system, and it must stay running. If it is offline in Discord, the process has stopped or was never started. Full setup lives on the Discord Bot Setup page; the quick checks are:

Is the process alive? Host it somewhere that keeps a Node process up — Railway, a VPS, or Pterodactyl. If you ran it on your own PC and closed the window, it is down; check your host's logs for a crash.

Check the .env. It needs BOT_TOKEN, CLIENT_ID, GUILD_ID, API_BASE, KEY_SYSTEM_ID, and API_SECRET. Remember the API_SECRET is shown once at key-system creation — if you lost it, rotate it and update the bot.

Commands missing? Confirm CLIENT_ID is the correct Application ID and that you invited the bot with the applications.commands scope alongside bot.

Permissions. The bot needs Manage Roles, Manage Channels, and Send Messages, and its role must sit above the buyer role it hands out — otherwise it cannot grant roles or open ticket channels even while online.

Each bot locks itself to a single server and automatically leaves any other it is added to. If your bot keeps leaving, the GUILD_ID in its .env does not match the server you invited it to — fix the ID, restart, and re-invite.

Where does my data live?

Everything lives on the website — the database and API at quarkexploits.com. That is the single source of truth, and the Discord bot and the loader are clients that read from and write to it, so anything you change in one place is reflected everywhere. Two related notes:

Your obfuscated real script is never in a public URL. The public/raw/ loader only fetches it from the server after the key and HWID pass, and even then the payload is obfuscated at your chosen tier.
Generated Roblox accounts, obfuscation builds, and license activity are all recorded in your History tabs on the site — nothing is lost if you close the tab.

Where do I get help?

For anything not covered here — setup questions, edge-case errors, purchases, or account issues — join the community Discord: https://discord.gg/AvfJCzRgUz. Deobfuscation, credential recovery, and other sensitive actions are staff/owner only, so open a ticket there rather than sharing keys or cookies in public channels.