Overemployed and mouse jigglers: what the tracker actually records

The advice the niche gives itself

On the Tech Setup page at overemployed.com the first item is a mechanical mouse jiggler, and the description carries a one-line instruction: avoid any detectable software-based jiggler. The Resources page repeats the same recommendation and adds a procurement detail — do not plug it into the laptop’s USB port, plug it into a wall charger instead, to stay out of endpoint detection.

That single sentence bundles two separate claims. One is about hardware inventory: a USB device attached to a managed laptop enumerates, and endpoint management tooling lists what enumerates. That claim is simply true, and the wall-charger tip is a sound response to it. The other claim is that software jigglers are detectable, and that one is worth unpacking rather than repeating.

We build software in this category, so nothing below should be taken on our word. Every figure here comes from instrument readings with the method published, and the parts we did not measure are listed at the end rather than left out.

What “detectable” means to a time tracker

No time tracker ships a mouse-jiggler detector. There is no signature list and no process scanner looking for jiggler software by name. What exists are two entirely different layers, and the popular advice collapses them into one word.

The first layer is the input API. On Windows, injected input carries a flag at the operating-system level, and the Hubstaff client uses it: its log writes one line for every second in which input arrived, and a second line marking the seconds in which all of that input was injected. So at this layer synthetic input is distinguishable from a hand on a mouse, and anyone who tells you otherwise is wrong about something that can be read straight out of a log file.

The second layer is the pattern. This is where a tracker’s scoring actually lives: how much of each interval contained input, whether movement came with clicks and keystrokes, whether the active window ever changed, and whether the shape of the day looks like a person or like a metronome. A flat line parked on one number is the pattern that stands out, regardless of what produced it.

So the useful question is not “can it be told apart”. It is “what does the tracker do with those seconds”, and that is a question with a measurable answer.

• Seconds of the interval that contained any input — this is the activity percentage.
• Whether input was exclusively injected, which the client records separately on Windows.
• Keystroke and mouse-event counts, which is why movement with no typing reads oddly.
• The active window and its title, which no input simulation changes.
• Screenshots on a schedule, which no input simulation changes either.

What we measured against a live tracker

Four unattended ten-minute blocks on 13 August 2026, on a Windows machine under a live Hubstaff account, with our own engine verifiably running for every minute of each block. Recorded activity came out between 74% and 80%, averaging 76.8%. The seconds were counted as input rather than discarded — which is the specific thing the popular advice implies will not happen.

The correction matters as much as the number. An earlier version of that study reported twenty-one blocks and a much wider range, because the selection criterion asked only whether the machine had been touched and whether the block sat inside a tracking session. It never asked whether our own software had been running, and on re-checking the engine had been running in four of them. The other blocks are an open question about that machine and evidence about nothing else, so they are not in the figures.

The full method, the per-block table and the correction are on the study page, along with the two commands anyone needs to repeat the second run without our software.

Where the hardware advice is right, and where it quietly is not

A mechanical jiggler is right about the layer it addresses. It physically moves a real mouse, so the input it produces carries no injected flag at all — at the API layer it is indistinguishable from a hand, because it is a hand’s worth of motion. Nothing is installed, no administrator rights are needed, and on a locked-down machine that matters.

What it does badly is the other layer. A dongle draws one trajectory at a fixed period, hour after hour, with no clicks and no keystrokes anywhere near it. Movement without clicks, at a constant interval, on an unchanging window, is a pattern — and pattern is exactly what the API flag does not cover. The device that is invisible to the first check is conspicuous to the second.

The two approaches therefore fail in opposite places, and neither is simply safer than the other. Choosing between them is choosing which layer you would rather be exposed at, and that is a very different question from the one the one-line advice answers.

• Hardware — clean at the input-API layer, crude at the pattern layer, visible to USB inventory unless powered separately.
• Software — flagged at the input-API layer, able to vary timing and movement at the pattern layer, installs on the machine.
• A browser tab — reaches neither layer: it can hold a screen awake and cannot touch the system idle clock a desktop tracker reads.

The thing that actually catches people is not the jiggler

This is the part the tooling conversation crowds out, and it is the part worth reading twice. In the accounts that circulate in this community, the mechanism of discovery is almost never a detector. It is a record that two parties can compare, or an image that explains itself.

Overlapping tracked hours are the clearest example. Two employers each running a tracker produce two timesheets, and hours billed to both at once are not an inference anybody has to make — they are a record sitting in two systems. No amount of input simulation touches that, because the problem is not what the input looked like but that the same clock was sold twice.

Screenshots are the second. A scheduled screenshot captures whatever is on screen, and a single frame containing the other employer’s tracker, ticket queue or video call is the entire story in one image. Input simulation changes nothing about what a screenshot shows.

Automatic reports are the third, and the least appreciated. Trackers generate anomaly reports without anyone requesting them — Time Doctor’s Unusual Activity report is the well-known one. The flag lands in a manager’s inbox on its own schedule, so “nobody is watching me” is not the protection it feels like.

• Hours that overlap between two timesheets — a record, not a suspicion.
• A screenshot containing the other job, which no input tool alters.
• Automatically generated anomaly reports that nobody has to ask for.
• Payroll, tax filings and background checks, which are not technical channels at all.
• Colleagues and calendars: being unreachable at predictable hours is noticed by people, not software.

What no tool settles: the contract

Whether a second job is permitted at all is a question about an employment agreement, not about software. Exclusivity clauses, moonlighting policies and conflict-of-interest rules differ by employer and by jurisdiction, and some of them make the arrangement a straightforward breach regardless of how any hour was recorded.

We are not going to pretend that an input tool changes that, and it is worth being suspicious of anyone who implies otherwise. What a tool of this kind addresses is one narrow technical question — whether an idle interval reads as idle — and that question is downstream of the contractual one, not a substitute for it.

What these figures do not prove

The measurement is small and deliberately described as such. Publishing a narrow result honestly is more useful to somebody making a decision than a broad claim that cannot be checked.

• Four blocks and forty minutes is a small sample; the range is what we stand behind, and the average summarises four readings.
• One machine, one operating system, one tracker, one account. Nothing here is measured on macOS.
• The figures are what the tracker’s client recorded in its log. A dashboard cross-check matched on 30 and 31 July 2026 but was not repeated on the day of these blocks, so the wording throughout is “the tracker recorded”.
• None of it is a guarantee about any percentage on your machine, your account or your employer’s configuration.