LUA File Documentation

---

Technical details

Feature	Value
Full name	Lua Script (source code)
File extension	.lua (compiled bytecode: .luac)
MIME type	text/x-lua
Format type	Plain-text source code (UTF-8 / ASCII)
Language	Lua programming language
Created by	R. Ierusalimschy, W. Celes, L. H. de Figueiredo (PUC-Rio, Brazil)
Introduced	1993
Current version	Lua 5.4
Open standard	Yes — language is documented; reference implementation is MIT-licensed
Comments	-- line and --[[ block ]]
Optional first line	Shebang #!/usr/bin/lua; may carry a UTF-8 BOM
Source signature	None (plain text; detect by keywords)
Bytecode signature	1B 4C 75 61 (ESC + Lua) — .luac only
Reference interpreter	lua (lua.org); JIT variant LuaJIT
Compiler	luac (source → bytecode)
Typical hosts	Roblox, World of Warcraft, Garry's Mod, Neovim, Nginx/OpenResty, Redis
Related extensions	.luac, .wlua, .js, .py, .txt
Specification	lua.org/manual/5.4/

What is a LUA file?

A .lua file is human-readable source code in the Lua programming language. Lua (Portuguese for “moon”) was created in 1993 at PUC-Rio, the Pontifical Catholic University of Rio de Janeiro, by Roberto Ierusalimschy, Waldemar Celes and Luiz Henrique de Figueiredo. It is a lightweight, fast scripting language, and its defining purpose is embedding: Lua was designed to be dropped into a larger host application written in C or C++ to provide scripting, configuration and extension. Its small size, speed and simple C API made it the de facto scripting language of the game industry and a common choice inside applications and embedded devices.

Because a .lua file is plain text, any editor opens it instantly, and there is nothing to “convert” the way you would a document. To execute a script you run it through a Lua interpreter — the reference implementation from lua.org, the just-in-time variant LuaJIT, or the Lua runtime embedded inside a host program, in which case the game or app loads the script itself when you place it where it expects (a mods or addons folder). The current language version is Lua 5.4.

The table: Lua's one structured type

Lua deliberately has a tiny set of types: nil, boolean, number, string, function, userdata, thread and table. The table is the only structured data type, and it does the work that arrays, dictionaries, objects and modules do in other languages. A table is an associative array whose keys can be any value except nil, and the same table can be used as a list and a map at once.

local point = { x = 10, y = 20 }        -- used as a record
local colours = { "red", "green", "blue" } -- used as an array (1-based)

print(point.x)        -- 10
print(colours[1])     -- "red"  (indexing starts at 1, not 0)

Two facts about tables trip up newcomers. Array-style tables are 1-based: the first element is colours[1], not colours[0]. And object-oriented code is built on tables plus metatables — a table attached to another table that defines how it behaves under operations like indexing (__index), addition (__add) or calling (__call). There is no built-in class keyword; classes are a convention layered on metatables. This is also why Lua does not transpile cleanly to other languages: its 1-based tables, metatables and coroutines have no direct equivalents.

Statements, comments and the shebang

Lua source is a sequence of statements. Variables are global unless declared local; blocks open with keywords like function, if, for or while and close with end. Comments run from -- to the end of the line, and a long comment spans --[[ to ]].

#!/usr/bin/lua
-- a single-line comment
--[[ a block comment
     spanning several lines ]]

local function greet(name)
    return "hello, " .. name      -- .. is string concatenation
end

for i = 1, 3 do
    print(greet("world"))
end

On Unix the first line may be a shebang (#!/usr/bin/lua) so the file can be executed directly; Lua treats a leading # line specially so the shebang does not cause a syntax error. Dependencies are pulled in with require, which loads another Lua module or a C library and returns its value. The .. operator concatenates strings, a small but frequently seen piece of syntax.

Embedding: how a host runs your script

Lua's design centre is that it rarely runs alone. A host application (a game engine, a database, a web server) links the Lua library and creates a Lua state, then exposes its own functions to Lua so scripts can drive the host. This is why the same .lua file means different things in different places: a World of Warcraft addon calls WoW's UI API, a Roblox script calls Roblox's game API, an Nginx/OpenResty script calls its request-handling API. The language is identical; the available functions come from the host.

This shapes how you “run” a mod or plugin. You usually do not invoke the interpreter yourself. You place the .lua where the host expects it — an addons directory, a mods folder, a config path — and the host loads and executes it inside its own embedded Lua runtime, with its own API already available. Standalone scripts, by contrast, run with lua script.lua from a terminal against the reference interpreter or LuaJIT.

Compiled bytecode: the .luac variant

Lua source can be pre-compiled to bytecode with the luac tool that ships with Lua: luac -o script.luac script.lua. The result is binary, not editable, and runs faster because the parse and compile steps are already done. Unlike source, bytecode has a signature: the escape byte 0x1B followed by the ASCII characters Lua (hex 1B 4C 75 61), then a version byte encoded in binary-coded decimal (0x54 for Lua 5.4), and several bytes recording the build's integer and number sizes and endianness.

Offset  Bytes            Meaning
  0     1B 4C 75 61      ESC + "Lua" signature
  4     54               version (0x54 = Lua 5.4, BCD)
  5     00               format (0 = official PUC-Rio format)
  6     ...              LUAC_DATA check bytes, size fields, endianness marker

Bytecode is tied to the exact Lua version and build that produced it, so a .luac compiled for one interpreter may not load in another. It is sometimes given a .lua name to be loaded transparently, which is why a file that looks like source but starts with 0x1B is actually compiled bytecode you cannot read as text.

Running a downloaded script: what Lua code can do

Reading a .lua in an editor is harmless, but running an untrusted one is not, because Lua is a full programming language with access to the system. A script can call os.execute to run shell commands, io.open and os.remove to read and delete files, and require to load native libraries. A malicious “free script” or game cheat can therefore delete files, exfiltrate data or run arbitrary commands the moment you execute it. Read a downloaded script before running it, take game addons and mods only from reputable sources, and be wary of obfuscated code or bare .luac bytecode you cannot inspect. Inside a sandboxed host such as Roblox the dangerous standard libraries are removed, which lowers the risk, though social-engineering “run this script” scams still circulate.

Frequently asked questions

How do I run a Lua script?

Install Lua (or LuaJIT) and run lua script.lua in a terminal. If the .lua is a game mod or app plugin, you do not run it directly — place it where the program expects (an addons or mods folder) and the host executes it inside its own embedded Lua runtime.

What is the difference between .lua and .luac?

.lua is editable source code; .luac is compiled Lua bytecode, a binary file that starts with the escape byte and Lua signature. Bytecode runs faster and hides the source, but is tied to the exact Lua version. You create it with the luac tool.

Can I convert a .lua to an .exe?

Not as a plain format conversion, but you can bundle the script together with the Lua interpreter into a standalone executable using tools such as srlua or luastatic. That packages the script to run on Windows without a separate Lua install; the .lua itself is still just source.

References

• Lua 5.4 Reference Manual
• Lua — About and history
• LuaJIT — just-in-time compiler for Lua

Feedback

Was this page helpful?

Yes No

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.