NoCapture
Back to Blog
Anti-Cheat
7 min read

Window Cloaking and Anti-Cheat: What Gamers Should Know

December 19, 2026
|NoCapture Team

The first question every gamer asks about window cloaking: will this get me banned? It's the right question, and most guides dodge it. Here's the honest answer.


How Anti-Cheat Actually Sees These Tools

Modern anti-cheat (Vanguard, Ricochet, EAC, BattlEye) runs at the kernel level. It monitors memory, drivers, injected code, and tampering with the game process. That scope matters, because capture exclusion does none of those things.

WDA_EXCLUDEFROMCAPTURE is an OS-native API. When a tool like Evanesco, CaptureGuard, or NoCapture protects a window, it calls SetWindowDisplayAffinity — the same API Windows itself uses, and the same API Discord and banking apps use to protect their own content. The window tells the display compositor: "exclude me from capture." No code enters the game. No memory is touched. No driver is loaded.

From anti-cheat's perspective, a cloaked Discord window is indistinguishable from Discord protecting itself.


The Kernel Bypass: A Different Category

Tools that hide windows by injecting DLLs into other processes, hooking the game's rendering pipeline, or installing drivers to block capture are a different story. That is the kind of behavior anti-cheat flags — not because it's inherently malicious, but because injection is injection, and kernel anti-cheat can't grade intent.

The dividing line:

  • OS-native display affinity (WDA-based): an OS contract, no injection, broadly invisible to anti-cheat.
  • Injection/hooking/driver-level hiding: interference with other processes, real detection risk.

If a tool can't tell you which category it's in, that's your answer.


Game-Specific Wrinkles

  • Games with aggressive overlays policies (some competitive titles restrict third-party overlays) care about things rendered into the game, not about unrelated windows being excluded from capture. Check the title's specific policy — it governs overlays, not compositor flags.
  • Faceit/ESEA-style clients scan more broadly. While WDA calls on a non-game window shouldn't trip anything, competitive players on these platforms should test during a non-match session first.
  • Tournament rulesets sometimes restrict any third-party tool. That's a policy ban, not a detection — read your event's rules.

NoCapture's Specific Behavior

NoCapture operates exclusively through OS-native APIs — display affinity for cloaking, window manager calls for title masking, system event hooks for notification shielding. It does not inject into, hook, or attach to any game process, and it does not install drivers.

That said, no vendor can promise what a future anti-cheat update will do, and we won't pretend otherwise. The pragmatic protocol: enable protection, play a casual session, confirm normal behavior, then play ranked. Five minutes of paranoia beats a support ticket.


The Bottom Line

The line isn't "privacy tools" versus "cheating tools." It's OS-native contracts versus process interference. Stay on the native side of that line, verify per-game, and your Discord can stay private without your rank being at risk.

NoCapture provides OS-level window cloaking, title masking, and notification shielding for Windows. Free for two windows. Because "being careful" isn't a strategy.

Anti-CheatGamingVACRicochetTechnical

Ready to control what your screen reveals?

Keep private windows out of screen shares, recordings, scrapers, bots, and AI agents.

Get NoCapture Free