Skip to content
GD Docs

Secrets

Secrets are 11 character strings used to validate if requests to the server were from a Geometry Dash client. Rather than generating a new secret for each request sent to the server, RobTop opted with hardcoing these secrets and slightly obfuscating them instead to stop people finding them.

  • Below is a table showing all known secrets

Table of Secrets

SecretType
Wmfd2893gb7Common
Wmfv3899gc9Account/MP
Wmfv2898gc9Level
Wmfp3879gc3Mod
Wmfx2878gb9Admin

Secret Types

As of Geometry Dash version 2.206, there are 4 publicly known secrets
  • Common Secret
  • Account Secret
  • Level Secret
  • Mod Secret

Common Secret

As of Geometry Dash 2.206, there are 44 endpoints on the server which use the Common Secret. Below is a table of all known endpoints which use the Common Secret.

Endpoints





Endpoint
https://www.boomlings.com/database/getAccountURL.php
https://www.boomlings.com/database/acceptGJFriendRequest20.php
https://www.boomlings.com/database/blockGJUser20.php
https://www.boomlings.com/database/deleteGJAccComment20.php
https://www.boomlings.com/database/deleteGJComment20.php
https://www.boomlings.com/database/deleteGJFriendRequests20.php
https://www.boomlings.com/database/deleteGJMessages20.php
https://www.boomlings.com/database/downloadGJLevel22.php
https://www.boomlings.com/database/downloadGJMessage20.php
https://www.boomlings.com/database/getGJAccountComments20.php
https://www.boomlings.com/database/getGJChallenges.php
https://www.boomlings.com/database/getGJCommentHistory.php
https://www.boomlings.com/database/getGJComments21.php
https://www.boomlings.com/database/getGJDailyLevel.php
https://www.boomlings.com/database/getGJFriendRequests20.php
https://www.boomlings.com/database/getGJGauntlets21.php
https://www.boomlings.com/database/getGJLevelLists.php
https://www.boomlings.com/database/getGJLevelScores211.php
https://www.boomlings.com/database/getGJLevelScoresPlat.php
https://www.boomlings.com/database/getGJLevels21.php
https://www.boomlings.com/database/getGJMapPacks21.php
https://www.boomlings.com/database/getGJMessages20.php
https://www.boomlings.com/database/getGJRewards.php
https://www.boomlings.com/database/getGJScores20.php
https://www.boomlings.com/database/getGJSongInfo.php
https://www.boomlings.com/database/getGJTopArtists.php
https://www.boomlings.com/database/getGJUserList20.php
https://www.boomlings.com/database/getGJUsers20.php
https://www.boomlings.com/database/getSaveData.php
https://www.boomlings.com/database/likeGJItem211.php
https://www.boomlings.com/database/rateGJStars211.php
https://www.boomlings.com/database/readGJFriendRequest20.php
https://www.boomlings.com/database/removeGJFriend20.php
https://www.boomlings.com/database/reportGJLevel.php
https://www.boomlings.com/database/requestUserAccess.php
https://www.boomlings.com/database/restoreGJItems.php
https://www.boomlings.com/database/unblockGJUser20.php
https://www.boomlings.com/database/updateGJDesc20.php
https://www.boomlings.com/database/updateGJUserScore22.php
https://www.boomlings.com/database/uploadFriendRequest20.php
https://www.boomlings.com/database/uploadGJAccComment20.php
https://www.boomlings.com/database/uploadGJComment21.php
https://www.boomlings.com/database/uploadGJLevel21.php
https://www.boomlings.com/database/uploadGJLevelList.php
https://www.boomlings.com/database/uploadGJMessage20.php

Account Secret

As of Geometry Dash 2.206, there are 5 endpoints which use the Account Secret. The Account Secret was created for endpoints that deal with important account features such as save data and privacy settings. However, some unused code in 2.2 also reveals that the secret could be used for the upcoming multiplayer mode, however this is subject to change. Below is a table of each endpoint which uses the Account Secret.

Endpoints




Endpoint
http://www.boomlings.com/database/accounts/registerGJAccount.php
http://www.boomlings.com/database/accounts/loginGJAccount.php
http://geometrydash.com/database/accounts/syncGJAccountNew.php
http://geometrydash.com/database/accounts/backupGJAccountNew.php
http://www.boomlings.com/database/updateGJAccSettings20.php
Known Multiplayer Endpoints



Endpoint
http://www.boomlings.com/database/exitMPLobby.php
http://www.boomlings.com/database/joinMPLobby.php
http://www.boomlings.com/database/uploadMPComment.php

Level Secret

As of Geometry Dash 2.206, there are only 2 endpoints that use the Level Secret. The Level Secret is used to handle level deletions. Below you can find the 2 endpoints which use the Level Secret

Endpoints
Endpoint
http://www.boomlings.com/database/deleteGJLevelUser20.php
http://www.boomlings.com/database/deleteGJLevelList.php

Mod Secret

As of Geometry Dash 2.206, there are only 2 endpoints which use the Mod Secret. These endpoints allow hand-picked users called moderators to send in-game levels to the server which then have a chance to earn a star rating. Below are the endpoints in question.

Endpoints
Endpoint
http://www.boomlings.com/database/rateGJDemon21.php
http://www.boomlings.com/database/suggestGJStars20.php

Admin Secret

In the client for Geometry Dash 1.9, RobTop mistakenly included the secret for Admin Endpoints inside of a function. Admin Endpoints are only accessible for game admins and they make direct changes in-game that affect everyone.

Below is a screenshot of the Admin Secret being created from Geometry Dash 1.9. RobTop split it into 6 segments to obfuscate it.

Currently, the Admin Secret no longer works as RobTop became aware of it

Secret Structure

A Secret is split into 5 components and can be divided as such: x|xxx|xxxx|xx|x. From analysing the available secrets that we have access too, we have a general idea of what each component may represent.

Note: The following is based on analysis using the endpoints the secret is used by as well as the status in the community one is required to have in order to access them. None of the information below has been proven

  • The first component of a Secret is always a W

  • The second component seems to denote the permissions level of the user
    mfd seems to be endpoints that anyone can use.
    mfv seems to be endpoints that anyone can use but, they handle important information regarding a users account - save data and levels.
    mfp seems to be endpoints that are restricted to a select few individuals - Geometry Dash Moderators.
    mfx seems to be endpoints that are restricted to everyone except Game Admins.

  • The third component is a 4-digit number which it’s purpose is unknown
    2893
    3899
    2898
    3879
    2878

  • The fourth component seems denote the purpose of the secret.
    gb seems to be general use.
    gc Seems to be specialised use - managing accounts, sending levels, deleting levels.

  • The fifth component seems to be overall power the endpoints have.
    3 being able to submit data that can greatly affect in-game levels
    7 being able to perform general activities on the server
    9 being able to alter accounts and remove levels from the server