Can Websites See You Switch Tabs, Copy or Screenshot?

Yes, a website can see when you switch tabs, and when you copy or paste. No, it cannot see a screenshot, a screen recording or what is in your other tabs. Both halves of that answer are true, which is why every forum thread on the subject has a confident top reply followed by an equally confident one saying the opposite.

The widget on this page is a working tab switch detector, and it is the quickest way to settle the argument for your own browser. Switch to another tab, highlight and copy a sentence, press Ctrl+P and cancel, then read what it logged.

Can a website tell when you switch tabs?

Yes. When a page is hidden or shown again, the browser fires a visibilitychange event and flips document.visibilityState between visible and hidden. A separate blur event fires on the window when it loses focus. Both come with a timestamp, so the page knows that you left and for how long. Analytics scripts lean on this: a hidden tab might never come back, so that is the moment they send off what they collected with navigator.sendBeacon. Quiz platforms use the same signals. In Classic Quizzes with quiz log auditing turned on, Canvas records when a student’s quiz page loses and regains focus.

What the page does not get is a destination. Switch away in the widget and come back, and the log shows how long you were gone and nothing else. The two events also measure different things:

Click into a chat window while the browser stays on screen and only blur fires, because the tab is still visible. Switch tabs and both fire. That is how a site tells a hidden tab from a window that merely lost focus. Cursor movement is a separate event: mouseleave fires when the pointer exits the window, and it is what exit-intent popups use to catch you heading for the tab bar.

Bots tend to show the opposite pattern. Automated browsers often never receive focus events, or report a page that is always focused, and the live behavior monitor on our homepage tracks that pattern. It is the kind of signal behavioral scoring can weigh, the same scoring behind the CAPTCHAs you keep getting.

Can a website see your other tabs?

Only its own. A page cannot list your tabs, read their titles or URLs, or look inside them. The same-origin policy walls sites off from each other, and no web API enumerates tabs. What a page can do is talk to other tabs of the same origin in the same browser profile, through a BroadcastChannel or storage events. That is how an app notices you opened it twice and asks which one to keep. Open this page in a second tab and the “Other tabs of this site” row counts it.

The one thing a page learns about your earlier browsing is where you came from. If you followed a link, document.referrer names the site the link was on, and usually only the site name, not the full address.

Can a website see what you copy and paste?

Yes, within limits. The copy and cut events fire on the document when you press Ctrl+C or use the menu, and a handler can read exactly what you had selected. It can also swap in different text, which is how some sites append “Read more at…” to everything you copy, a courtesy nobody asked for. selectionchange fires while you drag across text, so a page knows what you highlighted before you copy anything.

Paste works the other way round. A paste into the page fires paste and hands over the clipboard text, and beforeinput reports whether text was typed or pasted, so a form can tell your 400-word answer arrived in one piece. What a page cannot do is browse your clipboard. navigator.clipboard.readText() needs your permission and a page you are actively using, so text you copied in another app stays private until you paste it somewhere.

People ask about this most for text pasted from ChatGPT. The page sees that a paste happened and how much text arrived. It is not told which app or site you copied from, though rich-text formatting can sometimes hint at it.

Can a website tell if you screenshot or screen record?

No. No browser API reports a screenshot or a recording of your screen. The operating system makes it, outside the browser, and nothing is sent to the page, whether the tool is OBS, Snipping Tool or your phone’s side buttons. What looks like screenshot detection is one of three other things, and the last is not detection at all:

• A keyboard listener watching for PrintScreen. The widget shows the quirk: on Windows the page typically gets only the key release. On a Mac, the system swallows the Cmd+Shift+4 shortcut, so the page never sees all of it.
• A beforeprint listener. It fires on Ctrl+P and “save as PDF”, so a page does notice that kind of copy.
• Blocked capture. Streaming services often show a black rectangle in screenshots because the video travels through a protected path. That stops the capture without detecting it. Our Widevine DRM post covers how those protection levels work.

On phones the browser events are the same: a page is hidden when you switch apps or lock the screen. The belief that sites know about screenshots probably comes from native apps. iOS tells an app when you take a screenshot, and Android has had an official screenshot callback for apps since version 14, which is how a chat app can tell the other person. A web page in a mobile browser is not told anything.

Can Canvas or an online exam see you switch tabs?

It sees the focus loss, with timestamps, and shows the instructor that you left. It does not see where you went. That is the whole mechanism for a quiz that runs as a web page, and it is why the reports tend to say “left the page” and nothing more specific.

Proctored exams are a different class of software, and the claims get strongest there:

Respondus LockDown Browser is an installed program, and Proctorio is a browser extension with permission to read your tabs. Neither is bound by what a web page can do. If an exam seems to know more than a page could, look at what it asked you to install.

Can you stop a website seeing it?

Not without breaking the page, and the usual workaround leaves its own mark. Tools that fake these events work by replacing built-ins such as the document.hidden getter, and a replaced built-in gives itself away the same way stealth patches do in bot detection. So the realistic advice is short:

1. Assume the page sees focus, visibility and clipboard events. Do not suppress them. Real users produce the same events, and faking them is its own tell.
2. Clear the clipboard before you paste into a site. A paste hands the page the entire clipboard text, so if you copied a password or a recovery phrase a minute ago, copy something harmless over it first.
3. Treat a tab switch as weak evidence. It says you looked away, which is what people do all day. A quiz or exam site that penalizes it is guessing at intent.

If you run several accounts you switch windows all day, and every profile’s page logs each switch. That is fine. What gets accounts flagged is contradiction elsewhere, such as a profile whose language, clock and GPU disagree. Incogniton gives each profile its own self-consistent browser, so your window-switching looks like the ordinary noise it is. Whether a platform allows multiple accounts is set by its rules, so know them before you act.

Want to see what else a page can read without asking? The full browser scan covers the network, hardware and fingerprint side.