How to pick a safe RSPS: red flags and client safety

Red flags

• The client is an .exe from a file-sharing site, a Discord DM, or a link you were sent privately instead of the server's own website.
• It asks you to turn off your antivirus or add a folder exclusion "because of false positives".
• It asks for your Jagex, email or Discord login, or a "verification" code. No private server needs these.
• The website domain is very new and doesn't match the server name, or there is no website at all, only a Discord invite.
• Payment only by gift card, crypto, or "friends and family" PayPal (which has no buyer protection).
• Pressure: "limited" donation deals ending in minutes, staff DMing you first, or promises of real-money trading.
• Vote counts that don't fit the community. Thousands of votes but an empty Discord and few players online. On our list a daily vote audit removes suspicious votes, and the number removed is shown on each server page.

Checking the client or launcher

1. Download only from the server's official website (check the link on its listing here goes to the same domain).
2. Prefer a .jar client, which needs Java, or a browser client over an unsigned .exe launcher. A .jar can still be harmful, but a well-known server will have many players using the same file.
3. Upload the file to a multi-engine scanner such as VirusTotal before you run it. One or two vague detections on a Java client are common; many detections or names like "stealer" or "RAT" are not.
4. Watch what the launcher does. It should update game files, not ask for administrator rights or install background services.
5. If you can, run unknown clients in a separate Windows user account or a virtual machine.

A good server documents its client install step by step. For an example, see the SnowRSPS client install guide Affiliated (affiliated with this site).

Passwords and accounts

• Use a unique password for every server. Server databases do get leaked, and server owners can see what you type into their client.
• Never type your official RuneScape, email or bank password into anything a private server gives you.
• Turn on in-game PINs or two-factor authentication if the server offers it.

Donations

• Pay through a method with buyer protection (card, or PayPal "goods and services").
• Read the server's terms first: donations are usually non-refundable and vanish if the server closes.
• Start small. A server that has been online for months with regular updates is a safer bet than a brand-new launch.

If something goes wrong

1. Disconnect, uninstall the client and run a full antivirus scan.
2. From a clean device, change the passwords you may have typed, starting with email.
3. Dispute any payment you didn't authorise with your card provider or PayPal.
4. Tell us through the contact page and we will review the listing.

Frequently asked questions

Is it safe to download an RSPS client?

It can be, if it comes from the server's official website, passes a multi-engine virus scan and doesn't ask for admin rights or for you to disable antivirus. Use a unique password.

Can an RSPS steal my RuneScape account?

Only if you give it your details. A private server has no link to your Jagex account, so never enter your official login, email password or authenticator codes into a private server client or website.

Why does my antivirus flag an RSPS client?

Unsigned Java clients and launchers sometimes trigger generic detections. A few vague detections are common; many detections, or ones naming password stealers or remote-access tools, mean you should not run it.