An HWID spoofer is software that changes the hardware identifiers your PC reports, so a machine carrying a hardware ban presents itself as different hardware. It does not touch your account, your game files, or anything the publisher stores on its own servers. It changes what your system says about itself when something asks.
That distinction decides whether a spoofer is any use to you. As of September 2026, the five anti-cheat systems most likely to be behind a hardware-level block on a Windows PC are Riot Vanguard, Easy Anti-Cheat, BattlEye, EA Javelin Anticheat and Anti-Cheat Expert. Each reads system information differently, and none of them publishes the exact identifier set behind an individual enforcement decision.
This page explains what a HWID spoofer actually changes, how the change is made, what stays untouched no matter what you run, and where the real limits sit.
What Does an HWID Spoofer Change?
An HWID spoofer changes the serial numbers and identifiers that individual components in your PC report to software that asks for them. There is no single "hardware ID" stored in one place. What people call an HWID is a fingerprint, a composite built from values pulled out of several components at once.
The values commonly involved:
| Identifier | Where it lives | Typically spoofable |
|---|---|---|
| Disk serial number | HDD, SSD or NVMe firmware | Yes |
| MAC address | Network adapter | Yes |
| Motherboard UUID and serial | SMBIOS tables | Yes |
| CPU ID | Processor | Partially. Some fields are fixed |
| GPU identifier | Graphics card | Yes |
| RAM serial | SPD data on the module | Yes |
| Monitor EDID | Display firmware | Yes |
| Windows product ID and machine GUID | Registry | Yes |
The SMBIOS specification is a published DMTF standard, which is why motherboard-level values are so widely used. Any program can read them through a documented interface without special permissions, and they are stable across reinstalls.
Because a fingerprint is a composite, the number of values a tool covers matters more than whether it covers any particular one. Changing a MAC address and leaving the motherboard UUID intact produces a machine that still matches on most of the fingerprint. That is the flaw in most manual approaches people try first. They address one value out of eight.
A hardware ban works precisely because those values survive the obvious fixes. Reinstalling the game does nothing. Reformatting the drive clears the filesystem, not the serial written into the drive's firmware. Microsoft's own documentation notes that the volume serial number is regenerated on format while the hardware serial is not. A clean Windows install rebuilds the registry but leaves the motherboard, CPU and network adapter reporting exactly what they reported before.
That persistence is the entire reason publishers use hardware bans instead of relying on account bans alone. If you want the mechanics of the ban itself rather than the tool that works around it, we cover that separately in what a hardware ID ban is and how it works. How long one lasts varies by publisher, and Riot's approach in particular is documented in our breakdown of Valorant hardware ban duration.
A spoofer intervenes at the point where a value is read, not where it is stored. The physical serial on your SSD is unchanged. What changes is the answer your system gives when something asks for it.
How Does HWID Spoofing Work?
HWID spoofing works by intercepting the requests software makes for hardware identifiers and returning substituted values instead of the real ones. The component is never modified. The question is answered differently.
Where that interception happens is the main technical difference between one spoofer and another, and it decides how much of the fingerprint a tool can actually reach.
User-Mode Spoofing
User-mode spoofing operates at the same privilege level as ordinary applications. It can alter registry values, change a MAC address through the network stack, and modify identifiers Windows exposes through standard interfaces such as WMI.
It is simpler to build, simpler to run, and it requires no driver. It is also the weaker approach against anything that reads hardware directly, because a program with deeper access can bypass the layer a user-mode tool operates on and query the device itself. Anything reading below that layer sees the original value.
This is where free and script-based tools usually sit. They work against software that trusts the registry and stop working against anything that does not.
Kernel-Mode Spoofing
Kernel-mode spoofing runs as a driver at ring 0, the same privilege level as the operating system, and the same level several modern anti-cheats operate at. Riot's Vanguard is the clearest example: its driver loads at system startup rather than when the game launches, which is why a user-mode tool started afterwards has little to work with. From ring 0, a spoofer can intercept lower-level requests, including the IOCTL calls that query storage devices directly and the interfaces that expose SMBIOS tables, and answer them consistently.
Consistency is the part people underestimate. If a disk reports one serial through one interface and a different serial through another, the mismatch is itself a signal. The same is true across time: values that change mid-session, or drift between one query and the next, describe a machine that does not behave like real hardware. A spoofer that changes some values and misses others can leave a system looking stranger than it did before.
Alongside the identifier work, most tools also clear traces: registry entries, log files and leftover artifacts that associate the current machine with previous activity. Trace cleaning changes nothing about the identifiers a ban is built on. It is housekeeping around the main job, not a substitute for it, and a tool that only cleans traces is not a spoofer in any meaningful sense.
Temporary and Permanent Approaches
Spoofers fall into two broad groups: temporary ones, where the substituted identifiers apply for the session and the machine reverts on reboot, and permanent ones, where the change survives restarts.
Neither is simply better. Temporary approaches leave nothing behind, which matters if the machine is shared, sold, or used for work unrelated to gaming. Permanent approaches save you re-running anything, at the cost of carrying a modified fingerprint permanently.
Worth separating from both: how long you can access the software, and how you pay for it. A lifetime license and a permanent hardware profile are different things that get discussed as though they were the same. The full breakdown is in our guide to temporary and permanent HWID spoofers, and the difference between a subscription and a one-time profile is set out on the pricing page.
What an HWID Spoofer Does Not Change
An HWID spoofer changes what your hardware reports. Everything outside that is untouched, and most of the disappointment people have with spoofers comes from assuming otherwise.
It does not unban your account. Account sanctions live on the publisher's servers, attached to your login. Changing your machine's identifiers has no effect on a record Riot Games or Epic Games holds about an account. If your account is banned, it stays banned on a spoofed machine, on a new machine, and on someone else's machine. Where an account has been actioned, the route is a support ticket, not a tool. For Riot titles specifically, we cover how to appeal a Valorant ban and what does and does not get reversed.
It does not hide your IP address. Network-level restrictions are enforced against the connection you arrive on, not the hardware you arrive from. A spoofer and a VPN solve different problems and neither substitutes for the other. If the block follows your connection rather than your machine, changing serial numbers accomplishes nothing. We go through the distinction in does Valorant ban your IP address.
It does not remove behavioral flags. Where a system scores how an account plays rather than what machine it runs on, hardware identifiers are not the input being judged. Nothing about a changed disk serial affects a record built from match data. If you believe a flag was applied in error, investigating a suspected false ban is a different process to changing hardware.
It does not make cheating undetectable. A spoofer changes identifiers. It has no effect on whatever a scanner finds running in memory, and the two problems are unrelated. A machine that presents as new hardware while running something detectable gets flagged on the second count.
It does not change your physical hardware. Nothing is written to firmware and no component is altered. The serial on the drive is the serial on the drive, before and after.
It does not survive every update by default. Anti-cheat systems change. A method that works today can be read differently after a patch, and any vendor promising otherwise is selling certainty nobody in this category can supply.
The useful way to think about it: a hardware ban is one lock among several. A spoofer addresses that one lock. If your account is banned as well, the door still does not open. And working out which restriction you actually have is the step most people skip. For Valorant, the error code at login is usually the fastest tell, which is why VAN 152 and an account-level ban need different responses.
Compatibility, Limitations and Risks
Using an HWID spoofer carries real risks, and they are worth reading before you evaluate any specific tool.
The terms of service problem. Circumventing a ban breaches the terms of service of effectively every game that issues one. The practical exposure is losing accounts rather than legal trouble: publishers enforce through their own systems. What publishers do pursue in court is cheat development and distribution, as in the $10 million judgment Riot Games won against a cheat seller. Using a spoofer sits in a different category to selling cheats, but "not prosecuted" is not the same as "permitted," and anyone telling you it is has an incentive to.
Free spoofers are the main malware vector here. A spoofer needs deep system access to do anything useful, which makes it an ideal delivery mechanism for something else entirely. Free tools distributed through forums and Discord servers are where most damage reports originate. They run from stolen credentials through to systems left unbootable and Windows licenses deactivated. A tool running at ring 0 that turns out to be hostile has all the access it needs to do serious harm, and by design you cannot watch what it does.
Detection is an ongoing process, not a fixed state. Anti-cheat vendors update, and when a method becomes readable everyone using that tool is affected at once rather than individually. This is why claims of permanent undetectability should be read as a warning about the vendor rather than a feature of the product. The honest framing is that a spoofer is maintained against a moving target, and maintenance is the thing you are actually paying for.
Then there is compatibility, which gets glossed over more than any of the above. A tool built around Easy Anti-Cheat is not automatically effective against BattlEye, and neither tells you anything about Vanguard, which loads at system startup before Windows finishes booting. EA Javelin Anticheat and Anti-Cheat Expert are different again. Anyone advertising a single product that handles everything is describing a marketing position rather than a technical one. Check which anti-cheat protects your game before assuming coverage. Our supported games list pairs each title with the system behind it.
Hardware sets its own limits, and no software argues with them:
- Laptops with soldered components leave fewer values to work with
- Restrictive secure boot configurations change what a driver can load
- Machines where the motherboard itself carries the ban are the hardest case
No spoofer removes a value it cannot intercept.
One more, and it catches people out constantly. A clean machine with a fresh account behaves differently to a clean machine with an account that already carries a record. Hardware is one input among several. Treating the spoofer as the whole solution is how people end up re-banned inside a week and concluding the tool was fake.
Do You Actually Need One?
You need an HWID spoofer only if the restriction you have is attached to your machine rather than your account, and that is worth establishing before you spend anything.
Three checks separate the two, and none of them require a tool:
- Make a new account and try to play. If a fresh account on the same PC is blocked immediately or within a few minutes, the machine is being recognized. If the new account works normally, the restriction was on the old login and a spoofer changes nothing for you.
- Read the error rather than guessing from it. Most anti-cheats return a specific code, and the codes distinguish between account-level and machine-level enforcement. A generic connection error is neither. Valorant's VAL 5, for instance, is a session error rather than a ban, and people regularly mistake one for the other.
- Try a different machine on the same account. If the block follows the account to other hardware, it is an account ban. If the account works elsewhere, the original machine is the problem.
There is a fourth case people hit regularly: both at once. An account ban and a hardware ban issued in the same action look identical from the login screen, and clearing the hardware side leaves the account side exactly where it was. That is not a spoofer failing: it is two restrictions where the reader assumed one. Riot runs both kinds across its titles, and our guide to League of Legends hardware restrictions treats them as separate problems for the same reason.
Where the honest answer is that you do not need one:
- The account is banned and the hardware is not
- The block is network-level and follows your connection
- You are trying to evade a sanction you expect to be reversed on appeal. A pending review is worth more than a workaround, and circumventing while a ticket is open does not help the ticket
Where a spoofer is the relevant tool: the machine is recognized across accounts, the hardware is the thing carrying the block, and you have accepted that using one breaches the game's terms.
How Saturn Fits Into This Category
Saturn is a kernel-mode HWID spoofer for Windows 10 and 11. You download one loader, and your licence decides which anti-cheat systems it covers for you.
There are five licences: Vanguard, EAC, BattlEye, Javelin and ACE. Buy one and the loader covers that system's games. Buy several, or a bundle, and the same loader covers all of them. Nothing else changes about how you run it. FiveM coverage sits inside the BattlEye licence rather than being sold separately. Between them the five cover 61 games. Each system has a page of its own under anti-cheats, listing the titles it covers.
Splitting the licences by anti-cheat rather than selling one blanket product is a deliberate choice. Vanguard's kernel driver loads at system startup and behaves differently to Easy Anti-Cheat, which loads with the game. Charging separately for each is more honest than charging once and implying every system is equally handled.
Everything in the limits section above applies to Saturn as much as to anything else sold in this category. It changes hardware identifiers. It does not restore a banned account, hide your IP address, or survive every future anti-cheat update by default.
Every Saturn product includes a 24-hour free trial with no card required, just an email address to send the key to. Given how much of this category is unverifiable marketing claims, testing on your own hardware and your own game before paying is the only evaluation that means anything. See what Saturn covers and what it costs.
Frequently Asked Questions
What is a HWID spoofer in simple terms?
A HWID spoofer is a program that makes your PC report different hardware serial numbers than the ones it actually has. Games that ban hardware rather than accounts identify machines by those serials, so changing what gets reported changes whether the machine is recognized as the one that was banned.
Does an HWID spoofer change my actual hardware?
No. Nothing physical is modified and nothing is written to firmware. The serial numbers stored in your components stay exactly as they were. A spoofer changes the answer given when software asks for those values, which is a different thing from changing the values themselves.
Will a spoofer unban my account?
No. Account bans are records held on the publisher's servers and attached to your login, not to your machine. A spoofer has no access to those records and no effect on them. If both your account and your hardware are banned, clearing one leaves the other in place.
Are HWID spoofers against the terms of service?
Yes, for effectively every game that issues hardware bans. Circumventing enforcement breaches the terms you agreed to. The realistic consequence is losing accounts rather than legal action, but it is a genuine risk rather than a technicality.
Why do free HWID spoofers get warned about so often?
Because the access a spoofer requires is the same access malware wants. Running an unknown kernel-level driver hands complete control of your system to whoever wrote it, and free tools circulated through forums and Discord are the most common source of reports about stolen credentials and damaged installations.
Does one spoofer work against every anti-cheat?
No. Vanguard, Easy Anti-Cheat, BattlEye, EA Javelin Anticheat and Anti-Cheat Expert read system information differently, and a tool built for one is not automatically effective against another. Check which system protects the game you play before assuming a tool covers it.
How can I tell whether my ban is hardware-level or account-level?
The error you get at login is usually the clearest signal, and it varies by game. A restriction that follows every new account you create on the same machine points to hardware; one that lifts when you log in elsewhere points to the account. For Riot titles, our Valorant hardware ban guide covers the specific codes and what each one indicates.
Last reviewed: Sept. 16, 2026. Written by the Saturn Spoofer team.