Build timed, cheat-resilient online exams with server-enforced countdowns, Aiken question bank imports and one link per candidate. No extensions, no webcams, and no answer keys in the browser.
Or read the benchmark report: 3,601 submissions, zero lost.
Graduate Engineer Aptitude Screen
Question 7 of 40 · 2 points
38:12
server deadline · worker tick
A cantilever beam of length L carries a point load P at its free end. Where is the bending moment greatest?
Features
A lightweight online assessment platform with the parts that matter for a real exam, and nothing that makes a candidate install, grant or explain anything.
Security
Answer keys never leave the server. The deadline is fixed when the exam starts and re-checked on every save and submit. Tab switches and window blur are logged with sendBeacon, so the event lands even if the tab is closed.
Candidate experience
No extensions, no downloads. If the Wi-Fi drops, answers are already on the device and sync when it comes back.
Question banks
Paste Aiken text and preview every question before it’s added. Paste an email column straight from Excel or Sheets: duplicates collapse, bad addresses are flagged, and CSV export is one click.
3 valid · 1 duplicate removed · 1 to fix
Programs
Enroll a cohort once, and every module in the course opens to them. Add a sixth module next term and they’re already on it. One grid shows who finished what, and the gaps.
An escalating lockout per identifier, backed by the database, sits on top of per-IP limits. A locked account rejects even the right code.
Results export as RFC-4180 CSV covering the whole roster, never just the page you were looking at.
Paginated, searchable and filtered on the server. The assessment list dropped from 497 ms to 1.9 ms at that scale.
Integrity
Most exam cheating relies on the browser knowing something it shouldn’t: the answer key, or the right to decide when time is up. Arivoform keeps both on the server, then tracks focus in the open and tells candidates before they start.
What Arivoform never collects
Live in your browser
Two ten-minute timers started at the same moment. The left one trusts the browser, as many quiz tools do. The right one works like Arivoform: the deadline is fixed on the server, and a Web Worker re-derives the remaining time every 250 ms. Now try to cheat.
Browser-trusted timer
main thread10:00
endsAt = Date.now() + 10 * 60e3;
setInterval(render, 1000); // throttled when hidden
if (Date.now() > endsAt) submit(); // browser decidesArivoform
server deadline10:00
expires_at // persisted when the exam starts
worker: remaining = expiresAt − serverNow // 250 ms
save / submit → server re-checks expires_atExtra time the browser is giving awaynone yet
Throttling is simulated here (a tick every 6 s, as a hidden tab can see), and so is the clock change. Switch tabs for real and the left timer’s ticks get throttled by your own browser.
Switch to another tab or app, then come back. This page listens for the same two events Arivoform uses, visibilitychange and window blur, and queues them with navigator.sendBeacon, which the browser delivers even while the page is closing.
Disclosed up front. Candidates are told before the exam starts that focus is tracked, and each check can be switched on or off per assessment. In this demo, nothing leaves your browser.
This runs the Aiken parser from the Arivoform app: standard Aiken, plus multiple answers, POINTS: and True/False. Edit the text and every problem is named by its line number. Nothing is added until you confirm.
Import preview
Comparison
Legacy proctoring buys integrity with surveillance. Form builders and Quilgo-style add-ons are easy, but they were never meant to keep an answer key secret. Arivoform is the lightweight proctoring software in between.
Competitor columns describe typical configurations as of September 2026. Products change, so check each vendor’s current documentation. All trademarks belong to their owners.
Architecture
Postgres, the app and a TLS proxy, deployed with Docker Compose on any Linux VPS you already pay for. Your candidates’ results live in your database, on your server.
~/srv · zsh
$ git clone https://github.com/MrVoicer/arivoform.git && cd arivoform$ cp .env.example .env # your domain, secrets, database password$ docker compose up -d ✔ Container arivoform-postgres-1 Healthy ✔ Container arivoform-app-1 Started ✔ Container arivoform-backup-1 Started ✔ Container arivoform-caddy-1 StartedOne app container. Validation with zod on every route.
Queries via pg, no ORM. Migrations apply once and record themselves.
JWT sessions in httpOnly cookies, so there is no session store to run.
No managed services, no serverless platform, no vendor lock-in.
The bundled proxy terminates TLS. Already running nginx? Point it at the app instead.
A pg_dump on start and every 24 h, with 14-day retention by default.
Benchmark report · 1 September 2026
Measured on a throwaway 2 vCPU / 4 GB DigitalOcean droplet running the deployed Docker Compose stack, with the real rate limiter in the path. Every run checked what was stored, not only how fast it answered.
Read the full methodSubmit latency, one 40-question exam, 200 timers expiring over about 10 s
30msp95
41msp99
0errorsand 0 lost
The answers are never on the page. Before a question is sent to a candidate, the server strips its correct answer out of the payload, and all grading runs server-side over the stored responses. Opening developer tools, reading the network tab or saving the page reveals only the question text and its options.
No. Candidates take assessments in any modern browser with nothing to install. Integrity comes from the server-enforced clock, answer keys that never reach the browser, and tab-switch and window-blur tracking that candidates are told about before they start. There is no webcam, microphone, screen recording or kernel-level driver.
Answers save to the device immediately and to the server a few seconds later, with automatic retries. A dropped connection, a refresh or a closed tab loses nothing, and on resume Arivoform restores the newer copy rather than overwriting it with a stale one. The deadline is fixed on the server when the exam starts, so the clock keeps running while they are offline. If time runs out during an outage, the automatic submission keeps retrying until it lands.
On a 2 vCPU / 4 GB VPS, 200 candidates whose timers expire across the same ten seconds were served at a p95 of 30 ms and a p99 of 41 ms, with zero errors and zero lost submissions, and every stored score matched an independent re-grade. Squeezing all 200 submissions into a single second raises p95 to 1.2 seconds, which is a visible pause but still no errors and nothing lost. Concurrency is not metered and there is no seat cap.
Yes. Paste Aiken-format text or upload a UTF-8 .txt file, and Arivoform previews every question before anything is added, naming any line it cannot read by its line number. It imports up to 500 questions at a time, including multiple correct answers, True/False, and a points value per question. You can also export a set back out as Aiken text to reuse it in another assessment.
Every candidate gets one personal access link, and it opens every assessment they are on, including every module of a multi-part course. You export the links as a CSV and send them through your own mail merge, LMS or messaging tool. Alternatively, candidates can enter with their email address and the last four digits of the phone number on your roster. Repeated wrong guesses trigger an escalating lockout.
If you need timed, graded assessments where the answer key cannot be read from the browser, yes. Arivoform is a self-hostable online assessment platform with server-enforced timing, focus tracking, Aiken import, per-candidate links, programs with a consolidated gradebook, and complete CSV exports, all running from a single Docker Compose deployment you control.
Your server. Your candidates. Your results.
Deploy Arivoform on your own VPS this afternoon, or try the integrity layer right here first.