Is LockDown Browser Detectable? What Respondus Actually Sees

Before you trust any guide telling you how to beat Respondus LockDown Browser, you need to know what it's actually watching. Most students assume it's just "locking the browser." In 2026, that's a small fraction of what it does.

Layer 1: Screen capture

LockDown Browser samples your screen continuously. The recording is uploaded in chunks and reviewed by both an AI flagging system and, on flagged exams, a human proctor.

What it sees: every pixel that the operating system passes to the capture API. Anything excluded from that API at the OS level — system overlays, accessibility panels, certain notification UIs — never makes it into the recording. Lockdownify lives in that excluded category.

Layer 2: Webcam video

Your webcam streams continuously. The system tracks head pose, eye gaze, and whether additional faces appear in the frame. Multiple people in the room is an automatic flag.

What it sees: only what the camera physically points at. A small chat overlay on your screen — close to the question — doesn't pull your gaze far enough to register as suspicious. Looking down at a phone or notebook does.

Layer 3: Process scanning

LockDown Browser enumerates every running process on the machine and kills or refuses to start if it sees screen-recording, virtual-machine, remote-desktop, or known cheating-tool binaries.

What it sees: process names and signatures. Tools that ship with stealth process names and don't pattern-match any blocklist entry are not flagged. Lockdownify is invisible at this layer because the process scanner doesn't recognize it as a screen-capture or remote-control tool — it isn't either.

Layer 4: Keystroke patterns

Some versions analyze typing cadence, paste events, and rapid input bursts to flag autocomplete or copy-paste behavior.

What it sees: keystroke timing on the exam input field. Pressing a hotkey to summon a separate overlay window is not an exam-field input — the proctor's keystroke logger only records what you type into the answer box.

Layer 5: Network activity

Network traffic from the machine is monitored. Unusual outbound connections during an exam (to certain known cheating endpoints) get logged.

What it sees: traffic from monitored processes. Tools that route their traffic through standard categories — say, the same kind of API requests any chat app makes — don't stand out. Lockdownify uses normal HTTPS to standard model providers, identical to traffic from a dozen messaging and productivity apps.

Putting it together

Beating LockDown Browser isn't about defeating one check — it's about being invisible to all five. Most cheating methods fail at least one layer. AI overlays that are excluded at the OS level fail none.