What Employee Monitoring Software Can Actually See (2026)

Employee monitoring software collects less than most people fear and more than most employers explain. The gap between those two things is where the anxiety lives, and it is almost entirely closeable with a clear list.

This guide goes category by category through what these tools capture on a work machine, marks each as standard, optional, or myth, and notes which vendor category each belongs to. Where behaviour varies significantly between products, we say so rather than generalising.

The categories, at a glance

That split is the most useful thing to understand. Most remote workers encounter the left column, and most of the alarming stories circulating online describe the right column. They are different products bought by different kinds of organizations.

Input timing: the thing that is always collected

Every tool in this space measures whether your mouse or keyboard produced input, second by second. It is the foundation of the activity percentage and cannot be turned off while tracking.

What is stored per second is a yes or no, not a description. There is no cursor path, no coordinates, no velocity, and no record of which key was pressed. The full arithmetic, using Hubstaff as the worked example, is in how Hubstaff activity tracking works.

The limitation of this signal is severe and worth stating. It cannot distinguish valuable work from fidgeting, and it scores reading, thinking, and calls at zero. It measures machine input, and it is routinely read as if it measured effort.

Screenshots: common, and usually optional

Most tools can capture still images of your screen at intervals. In time trackers this is typically an optional setting, and plenty of teams leave it off. In full monitoring suites it is usually on by default.

Frequency is normally a handful of captures per 10-minute block at randomized moments, which means the images represent a tiny fraction of elapsed time. Many tools offer a blur option that stores the image obscured, so a reviewer can see the screen was in use without reading it.

The detailed behaviour, using Hubstaff as the example, is in our screenshot guide, including what happens on multiple monitors and when the timer is paused.

App and URL tracking: the setting that varies most

Tools can log which applications you have in the foreground and which websites you visit, with durations attached. This is the category where organizations differ most, and the one people most often assume is on when it is not.

What gets stored is names and addresses, not contents. App tracking records that an editor or a browser was in the foreground for some minutes. URL tracking records a page address, which on a search engine or a document tool can reveal quite a lot, and on a generic dashboard reveals almost nothing.

If you want to know one thing about your employer's setup, make it this one. It is a reasonable question to ask and the answer changes how you should think about the rest.

One thing app tracking does catch that people overlook: the name of any tool you run to manage your own activity shows up in that list like any other application. That is a separate consideration from whether the tool works, and it is covered in can mouse jigglers be detected.

What time trackers never do

These are the myths, and they persist because enterprise surveillance products that do some of these exist and get written about.

They do not log what you type

Time trackers register that a key was pressed and discard which one. Passwords, messages, and documents are not captured through the keyboard. They can appear in a screenshot if visible on screen, which is a different path.

They do not record video or audio

There is no continuous screen recording and no microphone access in mainstream time trackers. Still screenshots are not video, and the difference in coverage is enormous: three frames per ten minutes is roughly half of one percent of elapsed time.

They do not use your webcam

Webcam capture exists as an add-on in some enterprise surveillance products. It is not a feature of standard time trackers, and you can verify this in your operating system's camera privacy panel.

They do not read your files

There is no filesystem scanning. Products that inspect file contents are data loss prevention tools, a separate category with a separate purpose, usually deployed for compliance rather than productivity.

The verification steps for all of these, using Hubstaff as the example, are in does Hubstaff record your screen.

What your employer can see without any monitoring tool

This is the part that gets overlooked. On a company-owned machine and a company network, quite a lot is visible through ordinary IT infrastructure that has nothing to do with monitoring software.

• •Email and chat on company accounts, which the organization owns and can access through admin tools
• •Files stored in company cloud storage, along with access and edit history
• •Which sites were visited, through network or DNS logs on a corporate network or VPN
• •Which devices connected to the machine, through USB and device management logs
• •Which software is installed and running, through endpoint management
• •Badge and VPN access times, which show when you were present

None of this requires monitoring software. It is a consequence of the machine and the accounts belonging to the employer. People frequently worry about a screenshot tool while overlooking that their work chat is fully accessible by definition.

What no tool can see

The limits are real and they are structural rather than a matter of the vendor not having built it yet.

• •Whether the work produced was good, correct, or valuable
• •Whether a low-input hour was deep thinking or doing nothing
• •Anything happening on a personal device on a personal network
• •Work done on paper, on a whiteboard, or in conversation
• •Whether the person at the keyboard is the employee
• •Context. A screenshot shows one instant with no before or after

That first item is the important one. Every tool in this category measures proxies for work rather than work itself, and every proxy has a gap. The gap is not a flaw in a particular product, it is inherent to measuring activity instead of output.

The practical asymmetry

Because the metrics are proxies, they matter most when the thing they proxy for is invisible. A manager who can see delivered work rarely looks closely at an activity percentage. A manager who cannot see the work has nothing else to look at.

This suggests something more useful than any privacy technique: make your output visible. Regular, legible evidence of what you produced makes monitoring metrics close to irrelevant, and it is the one move that works regardless of which tools your employer runs.

What is reasonable to ask your employer

In most jurisdictions with meaningful workplace privacy rules, employers are expected to disclose monitoring rather than run it silently. Asking is normal, not suspicious.

1. 1Which tool is installed and what it collects.
2. 2Whether screenshots are enabled, and whether blurring is on.
3. 3Whether app and URL tracking is enabled.
4. 4Whether monitoring runs outside working hours or only while the timer is on.
5. 5Who can view the data, and how long it is retained.

A reasonable employer answers these in a few minutes. An employer who will not answer has told you something useful regardless.

Where Ghost Mode fits

Ghost Mode addresses one specific gap in the list above: input timing scoring genuine work as idle. It generates natural mouse movement, window focus changes, and keystroke timing so reading, calls, and thinking do not register as absence.

It does not affect screenshots, app logs, URL logs, or anything an employer sees through ordinary IT infrastructure, and we prefer to be explicit about that boundary rather than let it stay vague. It runs locally on Windows with no cloud component. Details are in the FAQ, and the tooling comparison is in mouse jiggler vs activity simulator.