Online exams detect some cheating, not all of it. A browser-based system sees what happens inside its own window: leaving it, exiting fullscreen, copying, and pasting. StudyDrome Exam Manager detects those four classes and judges them on the server. Nothing running in a browser can see a phone, a second computer, or another person in the room.
That gap is the whole subject of this article. Vendors rarely draw it, and exam offices buy on the assumption that "detection" covers everything. It does not. Knowing exactly where the line falls tells you which risks software can carry, and which ones your exam design has to carry instead.
Which cheating methods can exam software detect?
Start from how people actually cheat, not from a feature list. Each row below is a method. The middle column indicates whether a browser-based system raises any alerts during the exam.
Method | Detected during the exam? | What you actually see |
|---|---|---|
Switching to another window or tab | Yes | A window-leave event with a timestamp |
Leaving fullscreen | Yes | A fullscreen-exit event |
Copying the question text out | Yes | A copy attempt. The copy is also blocked |
Pasting an answer in from elsewhere | Yes | A paste attempt. The paste is also blocked |
Reading notes on paper | No | Nothing |
Using a phone or a second computer | No | Nothing |
Another person in the room | No | Nothing |
Screen sharing or remote desktop | No | Nothing |
Someone else sitting the exam | No | Nothing live. Access codes and device binding raise the cost without confirming identity |
Asking an AI tool on a second device | No | Nothing |
Asking an AI tool in another tab | Indirectly | A window-leave event, identical to any other window leave |
Two candidates working together | Not live | Afterward: submissions finishing seconds apart |
A question that has leaked | Not live | Afterward: that item's statistics shift |
Four rows say yes. Nine say no or not yet. That ratio is the honest state of browser-based detection, and it has not changed in years.
Notice what the four detected rows have in common. Each of them occurs within the exam window. That is not a coincidence, and it is not a gap any vendor can close with better code.
Why can a browser only see its own window?
A web page runs in a sandbox. The browser enforces it, and it is the same sandbox that stops a random website reading your files. An exam delivered as a web page inherits those limits.
Inside the sandbox, a page can tell when it loses focus. It can tell when fullscreen ends. It can catch a copy or a paste aimed at its own fields.
Outside the sandbox, it is blind. A page cannot list the programs running on the machine. It cannot see a second monitor, a second computer, or a phone on the desk. It cannot reach anything else on the network. Camera and microphone need explicit permission, and browsers show a visible indicator when either is live.
Clipboard contents sit in that outside category too. StudyDrome Exam Manager blocks the paste and counts it. What was on the clipboard is never read, sent, or stored.
This is why every product that claims to watch the room ships something other than a web page. A lockdown browser is a desktop application. It gains extra reach by operating outside the sandbox, and it must be installed on a machine the candidate controls. That is a real trade, with real costs in support load and access. Our guide to Safe Exam Browser works through what that category does and does not buy you.
So the question is not which vendor detects more. Two products delivered in a browser see the same four things.
Can exam software detect AI use in an exam?
Not from the answer. No exam system reads a paragraph and tells you a model wrote it.
What a browser can see is the route to the tool, never the tool itself. A candidate who opens a chatbot in a separate tab triggers a window-leave event. That event looks exactly like checking email or reading a message. It carries no label saying which site was opened, because the page cannot see other tabs.
A candidate who types the question into a phone generates nothing at all.
This lands badly for anyone hoping to buy the problem away. It lands much better for anyone willing to change the paper. An item that asks for judgment on supplied data is far harder to outsource than one that asks for a definition. That shift also improves the exam as a measurement, which no detection setting does. Writing flaw-free items is the practical starting point.
What shows up only after the exam?
Two things are invisible during a sitting and obvious afterward.
A leaked question changes shape. Its facility rises sharply against its own history while its discrimination collapses. Strong and weak candidates start giving the same answer. That pattern appears in a routine item analysis, and it is the clearest evidence of leakage you will get. Our item analysis in Exam Manager page covers the statistics involved.
Collusion leaves a timing signature. Across a sitting, each attempt carries the seconds elapsed since the previous one finished. A cluster of near-simultaneous submissions stands out immediately in the exam conduct report.
Read that second one carefully. The number is displayed, not interpreted. No threshold is applied, and no automatic flag is raised. It tells you where to look. It does not tell you what you found.
What should you do with a flagged attempt?
A flag is a prompt, never a finding. Treat it as one and most of the hard problems go away.
The mechanics are worth understanding. The browser reports events; the server maintains the counter and makes all decisions. Warning and auto-finish thresholds are checked server-side against the settings of the published exam. A candidate cannot change the outcome by tampering with the page. Attempts ended that way carry their own finish reason. It sits apart from a dropped connection or an expired clock. That is why losing internet mid-exam never reads as misconduct.
The harder part is policy, and no product sets it for you. Decide before the exam who will review a flagged attempt and to what standard. An appeal tests that review policy, not your detection settings.
Two habits protect innocent candidates. First, never let a raw count trigger an accusation. Window-leave events have mundane causes, so any usable system must suppress obvious false alarms rather than report every blur. Second, enable only the controls you can explain to a student, and write down the reason. A control you cannot justify at appeal is a liability, not a safeguard.
A checklist before your next online exam
- Write down which risk you are actually managing: casual lookup, collusion, item leakage or impersonation. Each has a different answer, and integrity plans usually blur all four.
- Mark every risk on that list that a browser cannot see. Those belong to exam design or to a supervised setting.
- Audit your highest-stakes paper for items that can be answered from a shared file or a chatbot. Rewrite those first.
- Check that your bank is large enough for random selection to be meaningful.
- Turn on only the controls you can justify to a candidate, and record why.
- Name the person who reviews flagged attempts, and the standard they apply, before the exam runs.
- Run an item analysis afterward and look for the leaked-item signature.
- Read the conduct report for submission clusters, then investigate rather than conclude.
Frequently asked questions
Can online exams detect cheating?
Partly. A browser-based exam detects four classes of behavior within its own window: leaving the window, exiting fullscreen, attempting to copy question text, and attempting to paste into an answer field. It cannot see a phone, a second computer, notes on paper, or another person in the room. Collusion and item leakage surface after the exam in submission timing and item statistics.
Can an online exam tell if you switch tabs?
Yes, but with less precision than most people assume. Switching tabs makes the exam window lose focus, and the system records a window-leave event with a timestamp. It cannot see which tab you opened or what was on it, because a web page has no visibility into other tabs. A window leave is the same event whether you opened a chatbot or a calendar reminder.
Can exam software detect a phone or a second device?
No. A page running in a browser cannot see other devices in the room or on the network. Nothing is recorded when a candidate reads from a phone or types into a second laptop. This is a limitation of the web platform, not of a single product. Managing that risk belongs to exam design, to item randomization, or to a supervised setting.
Can online exams detect ChatGPT or other AI tools?
Not directly. No exam system reads an answer and tells you a model wrote it. If a candidate opens an AI tool in another tab, the system records a window-leave event with no indication of the destination. If they use a second device, nothing is recorded at all. The reliable defense is an item that asks for judgment on supplied data.
Do you need a lockdown browser for online exams?
It depends on which risk you are carrying. A lockdown browser is a desktop application, so it can access more than a web page can. It also has to be installed on the candidate's machine, which adds support load and access barriers. For many exams, better item design and per-candidate access control remove more risk at lower cost. Alternatives to online proctoring compare the layers directly.
Does a flagged violation mean a student cheated?
No. A flag records an event, not an intent. A window-leave event can mean a notification, a file dialog, or a dropped connection. Any usable system suppresses the obvious false alarms before recording anything, and the finish reason keeps a technical failure separate from a rule breach. Decide who reviews flags, and against what standard, before the exam runs.
Where to go next
If you are choosing a platform, stop asking which one detects more. Ask what evidence each can put in front of an appeals panel, and what it had to collect to get there. Those are different questions, and only the first one matters at appeal.
If you are rebuilding an integrity policy, start with the rows in the first table that say "No". Software will never cover them. That is not a reason to distrust the software; it is the reason exam design still does the heavy lifting. Alternatives to online proctoring set out the layers that do.