How to make a sword in Roblox Studio

How a working sword fits together

A sword that works in a live game is split between the player's device and the server. Roblox's tools page says tool input belongs in LocalScripts, because only the player's device knows when input happens, and that most tools need a LocalScript, a server Script and a RemoteEvent between them. This guide uses exactly that split. One swing goes like this:

1. The player clicks, taps or presses the gamepad trigger with the Sword equipped. Tool.Activated fires in the LocalScript.
2. The LocalScript plays the swing animation, if there is one, and fires the SwordSwing RemoteEvent. It sends nothing else.
3. The server Script checks the cooldown, that the player is alive and that the Sword is in their hand.
4. The server builds its own hitbox in front of the player's character and finds every Humanoid inside it.
5. Each of those Humanoids loses health once, through TakeDamage.

ServerScriptService
  SwordService Script new
StarterPack
  Sword Tool new
    Handle Part new
    Blade Part new
      WeldConstraint WeldConstraint new
    SwordClient LocalScript new

Step 1: Build the sword Tool

1. In the Explorer, hover over Workspace, click the + button and insert a Tool. Rename it Sword. The server script looks for this exact name. You build the sword in the Workspace, as Roblox's tools page suggests, because that is where you can see its parts and move and resize them. The last step moves it to StarterPack.
2. Insert a Part into the Tool and name it Handle. This is the hilt, where the character holds the sword. It must be a direct child of the Tool, and it must be the only part with that name: with two Handles, Roblox picks one at random, and the character may hold the sword by its blade.
3. Insert a second Part into the Tool, name it Blade, and shape and place it so it sticks out of the top of the Handle.
4. Insert a WeldConstraint into Blade. In the Properties window, set its Part0 to Handle and its Part1 to Blade, so the sword stays in one piece while the player carries it.
5. Select both parts and make sure Anchored is off. An anchored part in a tool pins the character in place when they equip it. Also turn off CanCollide on both, so the blade does not bump into players and walls as you swing.
6. Select the Tool and untick CanBeDropped. When it is ticked, pressing Backspace drops the sword into the Workspace.
7. Drag the finished Sword from the Workspace into StarterPack. A Tool left in the Workspace is a pickup that one player collects, not a sword that starts in every player's Backpack.

A sword made from a single MeshPart works too: name that MeshPart Handle and skip the weld. If the character holds the sword at a strange angle when you test it, select the Tool and adjust its grip properties (GripPos, GripForward, GripRight and GripUp) in the Properties window.

Step 2: Add the server script

Hover over ServerScriptService, insert a Script named SwordService and paste the code below. It is the only place a sword hit can happen. The settings at the top are the lines you are meant to change.

-- Script in ServerScriptService named SwordService.
-- The only place a sword hit can happen: it checks the swing, finds targets in front
-- of the attacker with its own hitbox, and deals the damage.

local Players = game:GetService("Players")
local ReplicatedStorage = game:GetService("ReplicatedStorage")

-- Settings
local SWORD_NAME = "Sword" -- the Tool's name in StarterPack
local DAMAGE = 20
local COOLDOWN_SECONDS = 0.6 -- keep the same value in SwordClient
local HIT_RANGE = 6 -- studs in front of the attacker
local HIT_WIDTH = 5
local HIT_HEIGHT = 6
local FRIENDLY_FIRE = false -- false: players on the same team cannot hurt each other
-- Swings sent exactly COOLDOWN_SECONDS apart can arrive a little closer together after a
-- network delay, so the server allows this much slack instead of dropping a real swing
local NETWORK_SLACK = 0.1

-- The remote the sword's LocalScript fires. It carries no arguments: the server
-- decides who is hit, so there is nothing for a client to fake.
local swingEvent = Instance.new("RemoteEvent")
swingEvent.Name = "SwordSwing"
swingEvent.Parent = ReplicatedStorage

local lastSwing: { [Player]: number } = {}

local function isTeammate(attacker: Player, target: Player?): boolean
	if FRIENDLY_FIRE or not target then
		return false
	end
	-- Neutral players (no team) can always hit each other
	return not attacker.Neutral and not target.Neutral and attacker.Team == target.Team
end

local function onSwing(player: Player)
	-- 1. One swing per cooldown, however often the remote is fired
	local now = os.clock()
	local last = lastSwing[player]
	if last and now - last < COOLDOWN_SECONDS - NETWORK_SLACK then
		return
	end

	-- 2. The attacker must be alive and holding the sword
	local character = player.Character
	local humanoid = character and character:FindFirstChildOfClass("Humanoid")
	local rootPart = humanoid and humanoid.RootPart
	if not (character and humanoid and rootPart) or humanoid.Health <= 0 then
		return
	end
	local sword = character:FindFirstChild(SWORD_NAME)
	if not (sword and sword:IsA("Tool")) then
		return
	end
	lastSwing[player] = now

	-- 3. The server's own hitbox: a box in front of the attacker's root part
	local params = OverlapParams.new()
	params.FilterType = Enum.RaycastFilterType.Exclude
	params.FilterDescendantsInstances = { character }
	local boxCFrame = rootPart.CFrame * CFrame.new(0, 0, -HIT_RANGE / 2)
	local parts = workspace:GetPartBoundsInBox(boxCFrame, Vector3.new(HIT_WIDTH, HIT_HEIGHT, HIT_RANGE), params)

	-- 4. Damage each Humanoid in the box once, even if several of its parts are inside
	local alreadyHit: { [Humanoid]: boolean } = {}
	for _, part in parts do
		local model = part:FindFirstAncestorOfClass("Model")
		local target = model and model:FindFirstChildOfClass("Humanoid")
		if model and target and not alreadyHit[target] and target.Health > 0 then
			alreadyHit[target] = true
			if not isTeammate(player, Players:GetPlayerFromCharacter(model)) then
				target:TakeDamage(DAMAGE) -- does nothing while the target has a ForceField
			end
		end
	end
end

swingEvent.OnServerEvent:Connect(onSwing)

Players.PlayerRemoving:Connect(function(player: Player)
	lastSwing[player] = nil
end)

Step 3: Add the LocalScript in the Tool

Insert a LocalScript into the Sword Tool, name it SwordClient and paste this in:

-- LocalScript inside the Sword Tool, named SwordClient.
-- Tool.Activated fires on the player's device, so this script listens for the click,
-- tap or trigger, plays the swing animation and asks the server to swing.

local Players = game:GetService("Players")
local ReplicatedStorage = game:GetService("ReplicatedStorage")

local tool = script.Parent :: Tool
local swingEvent = ReplicatedStorage:WaitForChild("SwordSwing") :: RemoteEvent

local COOLDOWN_SECONDS = 0.6 -- the same value as in SwordService
local SWING_ANIMATION_ID = "" -- optional: "rbxassetid://" followed by your animation's id

local player = Players.LocalPlayer
local lastSwing = 0
local swingTrack: AnimationTrack? = nil
local trackCharacter: Model? = nil

-- Load the animation once per character. Animations started on your own character
-- from your device are shown to every player.
local function loadSwing()
	local character = player.Character
	if SWING_ANIMATION_ID == "" or not character or character == trackCharacter then
		return
	end
	local humanoid = character:FindFirstChildOfClass("Humanoid")
	local animator = humanoid and humanoid:FindFirstChildOfClass("Animator")
	if animator then
		local animation = Instance.new("Animation")
		animation.AnimationId = SWING_ANIMATION_ID
		swingTrack = animator:LoadAnimation(animation)
		trackCharacter = character
	end
end

tool.Equipped:Connect(loadSwing)

tool.Activated:Connect(function()
	local now = os.clock()
	if now - lastSwing < COOLDOWN_SECONDS then
		return -- the server enforces this too; checking here avoids wasted requests
	end
	lastSwing = now
	if swingTrack then
		swingTrack:Play()
	end
	swingEvent:FireServer()
end)

Activated fires for a mouse click, a tap on a phone and the trigger on a gamepad, so the same script works on every device. Roblox copies the Tool, and the LocalScript inside it, into each player's Backpack when their character spawns, so every player runs their own copy.

The LocalScript keeps its own cooldown only to avoid sending requests the server would ignore anyway. It is not a security check: a cheater can delete it, edit it or fire SwordSwing from their own code. The RemoteEvents guide explains why every remote has to be checked on the server, and Script vs LocalScript vs ModuleScript shows what a LocalScript can and cannot change.

How the server decides who is hit

When SwordSwing arrives, SwordService asks the client nothing. It builds a box in front of the attacker's character, where the server sees it, and asks the engine which parts are inside with workspace:GetPartBoundsInBox. That method replaces the older FindPartsInRegion3, which Roblox marks deprecated.

The box is centred 3 studs in front of the attacker's root part. That is the CFrame.new(0, 0, -HIT_RANGE / 2) offset: a CFrame faces along its negative Z axis, its LookVector. So the box reaches from the middle of the character to 6 studs ahead, and it is 5 studs wide and 6 studs tall. The query compares each part's bounding box, a quick box-shaped approximation of its volume, so round parts and meshes count as slightly bigger than they look. For a sword, that small margin helps.

The alreadyHit table is made fresh on every swing, so the same player can be hit again on the next swing once the cooldown has passed. That is the "once per target per swing" rule that Touched-based swords struggle with.

The script uses TakeDamage rather than setting Health. Roblox's reference says TakeDamage leaves a Humanoid alone while a ForceField protects it, and that setting Health directly ignores ForceFields. A player who spawns at a SpawnLocation gets a ForceField for 10 seconds by default (the SpawnLocation's Duration), so new arrivals cannot be hit the moment they appear.

Add a swing animation (optional)

SwordClient already plays an animation once you give it an ID. You make the animation once, in Studio's Animation Editor:

1. Insert a rig to animate. On the Avatar tab, click Character to open the Rig Builder and pick a rig that matches your game's avatars, for example R15 and then Block Avatar.
2. On the Avatar tab, click Clip Editor to open the Animation Editor, select the rig, and pose a short swing of the right arm.
3. Set the priority to Action: click the … button in the editor's playback controls, hover over Set Animation Priority and choose Action. Action ranks above Movement, Idle and Core, so the swing plays over the walking and standing animations instead of losing to them.
4. From the same … menu, choose Publish to Roblox. If your game belongs to a group, select that group in the Creator field before you submit.
5. Copy the animation's asset ID from the Toolbox, and in SwordClient set SWING_ANIMATION_ID to "rbxassetid://" followed by that number.

SwordClient loads the swing through the character's Animator, not the older Humanoid:LoadAnimation, which Roblox marks deprecated. Roblox's Animator reference says animations that a player's device starts on that player's own character replicate to the server and to every other player, so the LocalScript can play the swing and everyone sees it. It also says the Animator must be created on the server, so never create one in a LocalScript. Player characters normally have one inside the Humanoid, which is where Roblox's own animation example looks for it.

The animation is only for show. Hits do not depend on it, so a slow, missing or edited animation never changes who is hit.

What older sword tutorials get wrong

If you are comparing this guide with a video or a forum post, these are the differences that matter, with the reason each pattern is a problem.

What an exploiter can and cannot do

Assume a cheater controls everything on their own device. They can read and change your LocalScripts, and Roblox's security guide says they can fire RemoteEvents "at any frequency with arbitrary arguments". Here is what that means for this sword.

Two rows say "Possible", and that is honest. This sword stops a cheater from choosing who they hit, how hard and how often. It cannot stop them moving their own character. Roblox's security docs say clients control their character's movement and physics, and that movement checks have to be tuned to each game. For a competitive game, a server-side movement check is the next layer (the sprint guide builds one that warns about crude speed hacks and long teleports), or Roblox's server authority, which the docs described as a beta when we checked on 13 October 2026.

Step 4: Test it

1. Add something to hit. On the Avatar tab, click Character to open the Rig Builder, choose a rig (for example R15, then Block Avatar) and it is inserted into the Workspace. Move it a few studs away from your SpawnLocation.
2. Press Play, equip the Sword from the hotbar, walk up to the rig and click. A health bar appears over it after the first hit, because by default a Humanoid shows its bar only once its Health is below its MaxHealth. A Humanoid starts with 100 health, so the fifth hit knocks it out.
3. Click as fast as you can. Only one swing every 0.6 seconds does anything.
4. Step back about 8 studs from the rig, or turn your back to it, and swing. Nothing happens, because no part of it is inside the box.
5. Test against a real player. Choose Server & Clients in the test mode dropdown, set 2 clients and press Play. Hit the other player within 10 seconds of them spawning: nothing happens, because of the spawn ForceField. After that, each hit takes 20. By default, player characters also regain 1% of their MaxHealth every second, so their health creeps back up between fights.
6. If your game uses Teams, put both test players on the same team. With FRIENDLY_FIRE false, their swings do nothing to each other.

Keep the Output window open (Window menu, then Output) the whole time. These scripts print nothing when they work, so any red error from SwordService or SwordClient is a real problem. See Common errors.

Extending it into a combat system

Combos

Keep a swing counter per player on the server, next to lastSwing. If the previous swing was recent, add 1; otherwise start again at 1. Then pick the damage from the count, for example more damage on every third hit, and clear the counter on PlayerRemoving the same way. The client can keep its own count to choose which animation to play, because the animation never decides a hit. The box and the checks stay exactly the same.

Knockback

After TakeDamage, SwordService can push the target away with ApplyImpulse on the target's RootPart, in the direction of the attacker's rootPart.CFrame.LookVector. Roblox's reference says the push depends on the target's mass, and that a server Script can call it on a part the server owns or a part a client owns automatically. Each player's device simulates their own character, so test knockback on players with Server & Clients, not only on a rig.

Kill credit for a leaderboard

Just before target:TakeDamage(DAMAGE), record who hit last with target:SetAttribute("LastHitBy", player.UserId). In a server Script, connect each character Humanoid's Died event, read that attribute, find the attacker with Players:GetPlayerByUserId and add 1 to a Kills IntValue in their leaderstats. Create it next to Coins and Wins as in the leaderboard guide's Step 1, and change it on the server as in Step 2.

Blocking

Add a second RemoteEvent that the client fires when the block button goes down and up, and have the server set a Blocking attribute on that player's character, with its own rate limit. In SwordService, lower or skip the damage when the target's character has Blocking set. A cheater still chooses when they block, so keep the block short or give it a cooldown.

No hits through walls

The box ignores walls, so a swing can reach someone behind a thin wall inside the 6-stud box. To close that gap, cast a ray from the attacker's root part to the target's root part with workspace:Raycast, excluding the attacker's character, and skip the target if the ray hits something that is not part of the target.

Selling the sword or giving it out each round

StarterPack gives every player the sword on every spawn. To sell it instead, put it in the ShopItems folder from the shop GUI guide. That guide's catalogue already sells a Tool named ClassicSword, so either name this Tool ClassicSword and set SWORD_NAME to match, or change the catalogue entry. To hand it out only during a round, use the GiveRoundTool script from the round system guide: keep the Sword in ServerStorage instead of StarterPack, and change "RoundTool" in that script to "Sword".

Enemies to fight, and a ranged weapon

For an NPC that chases players, follow the NPC pathfinding guide. The sword damages it like any other Humanoid. For a weapon that hits from a distance with the same server-side rules, see the gun guide.

Common errors and fixes

Open the Output window (Window menu, then Output) before you press Play. Most sword problems either print an error there or come from a name that does not match.

Build it with RoCode

If you would rather not wire this up by hand, RoCode can build it in the place you have open. It is an independent AI coding agent, not made by Roblox: you describe the feature in its web chat, and its Roblox Studio plugin creates the Tool, the parts and the scripts in your Explorer, so you are not copying code out of a chat window.

RoCode cannot make the swing animation or upload one: make it in the Animation Editor and paste its ID. With plugin 3.9 or newer RoCode can run a short playtest and read the errors, but it does not move a character or click, so you test the swings yourself. Making a whole Roblox game with RoCode, system by system shows where a weapon fits. How RoCode connects to Studio.

Questions

Sources and further reading

• Roblox Creator Docs: In-game tools. building a tool in the Workspace, the Handle, welding, Grip, anchoring, and why most tools use a LocalScript, a Script and a RemoteEvent
• Roblox Creator Docs: WorldRoot:GetPartBoundsInBox. the box query, OverlapParams and the deprecated FindPartsInRegion3
• Roblox Creator Docs: Humanoid:TakeDamage. ForceField protection, the health bar and health regeneration
• Roblox Creator Docs: Network ownership. the Touched sword exploit
• Roblox Creator Docs: Security tactics and cheat mitigation. never trust the client
• Roblox Creator Docs: Network ownership, movement validation and physics exploits. what a client can do with its own character, and movement checks
• Roblox Creator Docs: Animation Editor. animation priority and publishing
• Roblox Creator Docs: Animator:LoadAnimation. which animations replicate from the client
• Roblox Creator Docs: Debounce patterns. why Touched fires several times for one contact

How the code was checked: every script on this page passes Luau's strict type checker against Roblox's API definitions (luau-lsp, 13 October 2026). A type check catches misspelt APIs and wrong types, not game logic, so playtest in Studio before you publish.