Hashed access codes
Run codes are stored as hashes, so even a glimpse of the database won't reveal them.
Access codes, shuffled questions, timers and attempt limits make cheating more work than the test itself. No webcam, no lockdown.
Give a run a short access code, or send each participant a link that is theirs alone. Require a verified email when identity matters.
Shuffle questions and answer options per participant, so neighbours don't see the same order. Timers and attempt limits hold even if a tab closes.
Focus tracking records every switch away from the test page, question by question, after telling participants exactly what is watched. No camera, no keystrokes.
Answers autosave, so a dropped connection never loses a participant's progress. If someone flags a bad question, your correction regrades every affected attempt.
Run codes are stored as hashes, so even a glimpse of the database won't reveal them.
Questions and options are ordered per participant, so copying from a neighbour is harder.
The clock runs on the server, so closing the tab can't buy extra time.
Cap attempts per run, with one active attempt at a time to stop parallel sittings.
Require a verified email when you need to be confident who is behind an answer.
Identity options βEntry points are rate-limited, so access codes and links can't be guessed by brute force.
Record when a participant leaves the test page β a disclosed signal, never proof on its own.
Watch attempts in progress with time remaining, and end one with a recorded reason.
Cap how many participants can enter a run. Anyone who already started keeps their place.
No, by design: no camera, no microphone, no keystroke logging, no browser lockdown. If you want behavioural deterrence, opt-in focus tracking records how often a participant leaves the test page, and tells them so before they start. Everything else is structural: access control, shuffling, timers, attempt limits and verified identity.
The live monitor shows every in-progress attempt with its progress, time remaining and focus signals. Signals are indicators, not verdicts β a notification or an accidental click counts too β so the record shows which question each exit happened on, and you decide what it means.
Access codes are stored hashed rather than in plain text, and the endpoints that accept them are rate-limited, so they can't be read from the data or guessed.
No. Only one active attempt is allowed at a time, so nobody can run two windows in parallel. Attempt limits per run also cap how often a test can be taken.
Yes. Timers run on the server, not the browser, so closing the tab, reloading or tampering with the page can't extend the window.
Questions and answer options can be shuffled per participant, so no two people see the same order. With timers and one active attempt, casual copying gets much harder, without surveillance.
Their answers autosave as they go, so a dropped connection or closed tab doesn't lose their work. They resume where they left off, within the run's time limit.
Set an access code, a timer and an attempt limit, and deliver a fair test without spying on anyone.