What Online Proctoring Software Actually Monitors in 2026
If you've taken a remote coding assessment or a video interview recently, there's a good chance some form of monitoring was running in the background. The category is broad — from a simple screen share on Zoom to a locked-down secure browser — and the details are rarely explained to candidates. This article is a plain-English overview of how these systems generally work.
The three broad categories
Most monitoring falls into one of three buckets, in increasing order of restriction:
- Video/screen sharing. A standard interview over Zoom, Microsoft Teams, or Google Meet. The interviewer sees your camera and whatever screen or window you choose to share.
- Browser-based proctoring. A web app (often a browser extension or tab) that can watch for tab switches, capture webcam snapshots, and flag when the test window loses focus.
- Secure/lockdown browsers. Dedicated applications that take over the machine, disable other software, and restrict what can run during the exam.
Knowing which one you're facing tells you almost everything about what's actually being observed.
What screen sharing can — and can't — see
This is the most common setup and the most misunderstood. A key technical detail: on video calls, you choose what to share — a specific window, a specific tab, or the entire screen.
- If you share a single window or tab, the other participants see only that surface. Content outside it is not transmitted.
- If you share your entire screen, everything visible on that display is captured.
Screen sharing transmits what the operating system composites onto the shared surface. It is fundamentally a video stream of pixels, not a keylogger or a file scanner.
What browser proctoring typically flags
Browser-based tools lean on signals the browser exposes to web pages:
- Focus/blur events — did the exam tab lose focus?
- Tab visibility — the Page Visibility API tells a page when it's hidden.
- Copy/paste and fullscreen exit events.
- Webcam snapshots at intervals, sometimes with automated "attention" heuristics.
These are behavioral signals inside the browser sandbox. They can't see arbitrary programs running elsewhere on your computer — a browser tab has no general view of the operating system.
What lockdown browsers do differently
Secure exam browsers are the strictest tier. They run as native applications with elevated permissions and may block screen recording, prevent virtual machines, disable copy/paste system-wide, and terminate disallowed processes. If you're in one of these, assume the environment is tightly controlled and follow the rules exactly.
Why the distinction matters
The takeaway for candidates isn't a loophole — it's informed expectations. A casual Zoom interview and a bank's locked-down certification exam are wildly different environments, and treating them the same causes needless anxiety in one case and rule violations in the other. Always read the assessment instructions, and when in doubt, ask the recruiter what tooling is required.
How HintLens approaches this
HintLens is a native Windows overlay, not a browser extension. Because it renders as its own on-screen layer rather than living inside the exam's browser tab, it operates independently of the page's focus and visibility events. During a standard video interview where you share a specific window, an overlay that isn't part of that shared surface simply isn't in the transmitted stream.
We're transparent about the boundaries: HintLens is built for interviews and practice assessments, and we encourage candidates to respect the terms of any exam that explicitly prohibits outside assistance. You can read more about how the overlay works on the features page.
Frequently Asked Questions
What does online proctoring software actually monitor?
It depends on the tier. Video and screen sharing streams the pixels you choose to share; browser-based proctoring watches in-browser signals like focus, tab visibility, and copy/paste; lockdown browsers control the whole machine.
Can screen sharing see windows I don't share?
No. If you share a single window or tab, participants see only that surface — content outside it is not transmitted. Sharing your entire screen captures everything visible on that display.
What can browser-based proctoring detect?
Focus and blur events, tab visibility via the Page Visibility API, copy/paste and fullscreen-exit events, and periodic webcam snapshots. It can't see arbitrary programs running elsewhere on your computer, because a browser tab has no general view of the operating system.
What do lockdown browsers do differently?
They run as native applications with elevated permissions and may block screen recording, prevent virtual machines, disable copy/paste system-wide, and terminate disallowed processes. If you're in one, assume the environment is tightly controlled and follow the rules exactly.
Does HintLens appear in proctoring?
HintLens is a native Windows overlay, not a browser extension, so it operates independently of a page's focus and visibility events. During a video interview where you share a specific window, an overlay that isn't part of that shared surface isn't in the transmitted stream.
The bottom line
"Proctoring" is not one thing. Screen sharing streams the pixels you choose to share; browser proctoring watches in-browser signals; lockdown browsers control the whole machine. Understanding which one you're in is the difference between walking in confident and walking in guessing.