Safe Exam Browser with Evalmee: what it does, what it does not

Safe Exam Browser, or SEB, is a free, open-source application that replaces the browser during an exam. It is developed and maintained at ETH Zurich, and downloads from safeexambrowser.org for Windows, macOS and iOS.

Once launched, SEB puts the computer into kiosk mode: full screen with no address bar, no application switching, no keyboard shortcuts, no screenshots, and only the addresses its configuration allows. It is the textbook secure exam browserSecure exam browserA dedicated application that replaces the ordinary browser during the exam and locks down the workstation. It offers stronger control than a simple in-browser restriction, but requires an installation, rules out certain devices and shifts part of the technical support burden onto the institution.See the full definition: stronger control than a mere restriction inside the browser, at the cost of an installation on every machine.

Everything is decided in a configuration file, prepared by the institution for each exam. It sets the start address, the reachable sites, the password needed to quit, and whether the participant may switch to another application or reload the page. The same file can be reused from one exam to the next, as long as the address and the rules do not change.

SEB locks down the computer, not the room. It blocks other applications, other tabs, shortcuts and free navigation. It sees neither a phone on the participant's lap, nor a second computer, nor paper notes, nor the person dictating the answers.

That limit is not a design flaw: a browser lockdownBrowser lockdownRestriction of the candidate's software environment during the exam: full screen imposed, tab switching blocked or flagged, copy-paste and printing disabled. The measure raises the cost of opportunistic cheating, but can do nothing about a second device sitting next to the computer.See the full definition acts on the workstation and nothing else. Two points are often misunderstood. A connected second monitor is only blocked if the configuration expressly forbids it. And SEB records nothing: if a doubt arises after the exam, there is no video, no screenshot and no log to go back to.

Evalmee works the other way round: rather than preventing, it detects and reports. The two approaches do not cover the same ground, and neither sees what happens away from the machine. The table below separates the three perimeters.

Three cost items, all borne by the institution: an installation on every computer, a configuration file per exam, and technical support on exam day.

The installation needs administrator rights on the machine. In a room, on computers the institution manages, it is done once and holds. Remotely, on each participant's personal computer, it fails on a share of the machines, and not always the day before: an antivirus that blocks it, an OS version too old, an account without rights. Those cases land on the institution's support desk, not the vendor's.

The configuration file is prepared and tested before each exam. A mistyped address or an overly strict rule only shows up at launch, when the participants are already at their screens.

Always the same ones, and they are not faults in the software: they are what a lockdown browser is. Installing on every machine, writing a correct configuration, keeping it current, absorbing the incidents at launch, and living with what the lockdown takes away from the candidate.

Safe Exam Browser is free, open and documented by its own project, and nothing below is a hidden flaw: it is what locking down a candidate's machine asks of an institution. The same points come back with any lockdown browser.

Two things help in reading the table. Most of these limits are configurable: allowing a calculator or an online dictionary, tolerating a second monitor, permitting a page reload, all of it is written in the configuration file, and that is where the work moves to. But the exam's digital accessibilityDigital accessibilityThe design of a digital service so that it can be used by people with disabilities: compatibility with screen readers, full keyboard navigation, sufficient contrast, content that is never conveyed by sight or sound alone. It is verified by audit, not by a statement of intent.See the full definition is then decided inside that file: an assistive tool that lives in another application has to be planned for in advance, when it can be.

On 16 July 2026, in a webinar run by ANSTIA, Gianluca Quercini, a teacher and researcher at CentraleSupélec in France, described the tool he used before Evalmee for his continuous assessment. Safe Exam Browser was part of it.

He first notes that this previous tool had no native cheating detection, then says the answer adopted was a secure exam browser, Safe Exam Browser, and that it was « pas impeccable », not flawless: students ended up getting around the barriers. Those are his words, about his own use, on a given date, and not a measurement. Both passages are linked below, to the second.

That does not mean a lockdown is pointless. It says, in other words, what the project's own documentation says too: the lockdown covers the machine, and a determined candidate looks elsewhere. The full session, with its chapters, can be watched from the webinars page, and the case study below carries its timestamped transcript.

Moodle has integrated Safe Exam Browser as standard since version 3.9. In a quiz's settings, the option 'Require the use of Safe Exam Browser' refuses any attempt opened from an ordinary browser.

Three modes exist: configure manually from MoodleMoodleAn open-source learning platform, distributed under the GPL licence and very widely deployed in French-speaking higher education. Its openness explains why it serves as the reference for integration: an assessment tool that does not plug into it forces teachers to keep two lists of students.See the full definition, upload your own configuration file, or rely on the configuration of the SEB client installed on the machine. In manual configuration, Moodle generates the file itself, and a few checkboxes decide whether the participant sees a quit button, may switch applications, may reload the page.

Verification rests on two keys computed from the configuration, the Config Key and the Browser Exam Key. Moodle compares them with those SEB presents on every request, and thus knows that the connecting browser really is SEB, with that exact configuration, and not an ordinary browser posing as it. The detail of those keys belongs to the Moodle and SEB documentation, not to this page.

An institution whose exams live in Moodle can also open Evalmee from the course over LTI 1.3: enrolments synchronise and grades flow back to the gradebook, with no lockdown browser involved. The exact scope is described on the integrations page.

Three paths, and only one of them needs Safe Exam Browser. By default, the exam takes place in a standard browser. When the institution wants to go further, the optional desktop app for Mac and Windows is easier to use and to deploy than a lockdown browser. And Safe Exam Browser can be used with Evalmee on the Organisation plan, on request, with a configuration file supplied by Evalmee.

Let us start with the third path. An institution set on Safe Exam Browser contacts the Evalmee team before the exam: the team supplies the configuration file to use. It is available on the Organisation plan, and it is arranged case by case. In every other case, the desktop app is enough, and it spares the deployment work a lockdown browser demands.

Without a lockdown browser, Evalmee does not lock down the machine: it detects specific events during the exam, gathers them in an integrity report with a risk score, and lets the examiner decide. Full screen is mandatory, and the participant is warned when they leave the exam screen. Copy and paste and the presence of a second monitor are detected. Screenshots are triggered by four known events: leaving the window, using another application, leaving full screen, and the detection of a suspicious browser extension. If the institution enables it, the webcam and microphone record the whole session. None of this needs a lockdown browser, and all of it is set out on the proctoring page.

The integrity report gathers those events, their timestamps and a risk score for misconductExam misconductAny conduct aimed at obtaining a mark that does not reflect the candidate's own work: unauthorised documents, communication with a third party, impersonation, undeclared use of a generative tool. How it is classified and what follows from it are set by the institution's regulations.See the full definition. That score is not a verdict: it closes no exam and flags nobody in place of the examiner, who alone decides. That is the frame the GDPR sets for proctoringProctoringThe supervision of an exam sat remotely, on the candidate's own computer, to guarantee that the mark belongs to the person enrolled. The word covers a family of arrangements rather than one product: depending on the set-up, an identity check at the start, video and audio capture through the webcam, monitoring of the screen or of the open tabs, and an analysis of the session's events. Three levels are distinguished. Live proctoring: a human invigilator follows candidates in real time and can intervene. Record-and-review proctoring: the session is recorded and reviewed afterwards by an examiner. Automated proctoring: algorithms flag atypical events, face absent, second person, window switched, which a person must then examine. Example: for a remote end-of-module exam, the institution opts for an identity document check by the invigilator, tab locking and automated flags reviewed by the teacher, with no analysis of gaze or emotions. Wherever the GDPR applies, the frame is the same: the institution is the data controller, the arrangement must stay proportionate to the stakes of the exam and collect no more than that justifies (article 5), candidates must be informed beforehand (article 13), no decision with a significant effect may be taken by a machine alone (article 22), and the processing usually calls for a data protection impact assessment (article 35).See the full definition: a system proportionate to the stakes of the exam, candidates informed beforehand, and no decision taken by a machine alone.

This path has a downside, and it is accepted: in a standard browser, Evalmee cannot stop a participant from opening another tab. It sees it, timestamps it, captures it and reports it. An institution that wants to forbid rather than record goes through a lockdown browser, which is the request described above.

This is the recommended path when an institution wants more than an ordinary browser without carrying the deployment cost of Safe Exam Browser. The app exists for Mac and Windows. It is optional, it simplifies the candidate's experience, and the exam can still be taken without it, from a browser.

It is the only software Evalmee offers to install, and nobody is forced to: a participant without administrator rights on their machine takes the exam in their browser with the same detections. It is easier to use and to deploy than Safe Exam Browser. The paper itself is never downloadable in advance: it is loaded when the participant opens the exam.

In a room, on computers the institution owns and administers, a lockdown browser is a reasonable choice: the installation is done once, support is on site, and the room sees what the software cannot.

Remotely, on each participant's personal computer, the equation changes: the installation becomes the first cause of incidents, and the lockdown still covers neither the phone, nor the second machine, nor the person sitting next to them. That is where event detection, optional webcam recording and an examiner who decides deliver something the lockdown alone does not.

An institution that imposes Safe Exam Browser on its machines can run an Evalmee exam on them. It is available on the Organisation plan, on request: contact the Evalmee team before the exam and it supplies the configuration file to use.