HWID Spoofer Explained: How Hardware Bans Work and How an HWID Changer Gets You Back In

An HWID spoofer, also sold as an HWID changer or hardware ID spoofer, is a tool that changes the identifiers anti-cheat software reads from your PC's parts: disk serials, motherboard IDs, MAC addresses and a few others. If a game has hardware-banned you, a spoofer makes the same machine show up as one the anti-cheat has never met.

Below, we go through how hardware bans are actually put together, which serials an HWID changer swaps, and why the work has to happen at kernel level. You'll also find temporary versus permanent spoofing, how EAC, BattlEye, Ricochet, Javelin and Vanguard handle bans, and what no spoofer can fix.

What a hardware ban actually is and why new accounts don't help

A hardware ban, or HWID ban as most forums call it, is filed against your PC rather than your login. When an anti-cheat catches you, it stores a fingerprint of your parts with the ban: the drive's serial, the motherboard's UUID, your network adapter's MAC address and, in newer games, TPM identifiers.

That's why a fresh account rarely buys you more than a few matches. The PC still reports the serials the ban was filed under, and the anti-cheat checks those long before it cares about your username. Some people get kicked on the first launch. Others get a day or two of play before the next ban wave picks them up.

Bans also travel with the parts. In October 2026, Cybernews reported on a buyer who picked up a second-hand Ryzen 7 5800X3D and found they'd inherited the previous owner's Valorant hardware ban. According to the buyer, the ban also flagged the motherboard and drive in their own system. AMD's firmware TPM runs inside the processor, which is the most likely reason a CPU could carry a Vanguard ban from one PC into another.

What a hardware ID spoofer changes, serial by serial

Anti-cheats collect a whole set of identifiers, so a spoofer has to cover the set. Here's the list from our own tool's options screen:

• Disk serials: the serial each SSD or hard drive reports from its own firmware.
• Partition and volume IDs: the GUIDs and volume serials Windows stamps on a drive when it's formatted.
• Network adapters (MAC) and ARP cache: your network card's hardware address, plus the cached MAC addresses of devices on your local network, router included.
• SMBIOS: the firmware table that holds your motherboard serial and system UUID.
• EFI variables: small values in the board's firmware storage that Windows and boot-time software can read.
• Display adapters: the identifiers your graphics card reports.
• Monitor EDID: the data your monitor sends over the cable, often including a serial number.
• File and registry cleaning: removes the logs, caches and registry entries that keep copies of the values above.

The ARP cache is the one people forget. It lists the MAC addresses of other devices on your network, router included, and spoofer developers have long treated it as readable by anti-cheats. If they're right, a new MAC on your own card doesn't get you far while the router's MAC still matches the one on file.

Miss one category and the rest barely count. A spoof that changes the disk serial but leaves SMBIOS and EDID alone still gives the anti-cheat plenty to match on.

How an HWID changer works at kernel level, and why the seed matters

The cheap way to change an HWID is a user-mode program that edits registry values such as MachineGuid, and plenty of tutorials on how to change HWID still describe exactly that. Against modern games it does next to nothing, because the anti-cheats query hardware through their own kernel drivers instead of the registry.

Kernel-level spoofers load their own driver into ring 0, the privilege level the anti-cheat runs at. When something asks the storage stack for a disk serial or reads the SMBIOS table, the driver intercepts the request and returns a substitute. Every caller gets that substitute, the anti-cheat included. Windows is a caller too, which is where the activation trouble in the next section comes from.

The other thing that separates a good driver from a bad one is the seed. A well-built spoofer doesn't roll a separate random number for each identifier; it derives a full identity from one seed, so the disk serials, board UUID and MAC addresses all belong to the same imaginary PC. That consistency matters more than randomness, since real hardware doesn't report a new serial every time it's asked.

Our loader shows a new seed when a spoof completes.

Temporary vs permanent HWID spoofer: which one fits your situation

Temp spoofers do all their work at read time. The driver swaps values as they're requested and writes nothing to firmware or to the drive, so when you reboot, the PC goes back to reporting its real serials. You run it again before each session.

With a permanent HWID spoofer, the stored values themselves get rewritten, so the new identity survives restarts and there's nothing to load before you play. Some people reserve the name HWID changer for this kind, since it really does change what's stored. Because it writes to firmware tables and drive data, it depends more on your hardware cooperating, and some boards are fussier about those writes than others.

Perm is also harder to undo. Windows ties its digital license to your hardware, and streaming DRM checks it as well, so after a permanent spoof Windows can ask to be reactivated and services like Netflix may refuse to play. Getting the original serials back isn't always a one-click job.

Temporary suits you if you share the PC or want to try spoofing before committing. It's also the usual pick for people who aren't banned yet and want their real serials kept out of any future ban. Permanent is for the player who's already banned, plays most days and is sick of an extra step after every reboot. We ship both kinds.

HWID changer vs HWID cleaner: why you run Clean before Launch

Spoofing changes what your PC reports; cleaning deletes what it remembers. Skip the clean, and a freshly spoofed machine can pick up a second HWID ban from leftovers alone.

After a ban, your system is full of evidence: leftover cheat files, driver remnants, registry keys and logs. A few of those traces hold your old serials in plain text. The rest can be just as bad, because they show that a known cheat once ran on this install, and that alone can tie your new identity to the old one without touching the hardware.

Our loader splits the job into separate Clean and Launch buttons, used in that order. Clean wipes the system traces, then you reboot so Windows comes back up from the cleaned state. After that, Launch runs the spoof, and once the loader shows a new seed you're done and can start the game.

EAC, BattlEye, Ricochet, Javelin and Vanguard: what each anti-cheat bans on

Easy Anti-Cheat covers Fortnite, Rust, Apex Legends, Dead by Daylight and plenty more. Its driver loads with the game and, from what spoofer developers have mapped over the years, leans mostly on disk, board and network identifiers, so any EAC spoofer worth using gets those right first. BattlEye, used by Escape from Tarkov, PUBG, DayZ and Rainbow Six Siege, also loads with the game and looks much the same from the spoofing side.

Call of Duty is Ricochet territory, with Warzone, Black Ops 6 and Black Ops 7 all running Activision's kernel-level anti-cheat, while Battlefield 6 uses EA Javelin, also kernel-level. Riot Vanguard on Valorant is the one most people find hardest, mainly because its driver starts with Windows by default rather than with the game.

Hardware security is where things really changed. In August 2025, Battlefield 6 and Black Ops 7 both announced TPM 2.0 and Secure Boot as PC requirements. Valorant got there first: it has demanded both on Windows 11 since 2021, and Vanguard is widely reported to lean on the TPM to make hardware bans stick. Epic followed for competitive play, and since February 2026 Fortnite's PC tournaments have required Secure Boot, TPM and IOMMU.

Secure Boot stops unsigned boot components from loading, and the TPM gives the anti-cheat an identifier that sits underneath anything Windows reports. On these games, kernel-level spoofing is the baseline now. Our HWID spoofer runs with Secure Boot left on, so you don't have to choose between passing the launcher check and spoofing.

Valorant HWID spoofer: why Vanguard bans are a different job

By default, Vanguard doesn't wait for you to open Valorant. Its driver, vgk.sys, loads at boot and stays up until you shut down. By the time you'd normally start a spoofer, Vanguard has already had a good look at the machine.

Riot added an opt-in On-Demand mode on June 25, 2026, which loads Vanguard only when a Riot game starts. It needs Windows 11 25H2 with TPM 2.0, Secure Boot, VBS, HVCI and IOMMU all switched on. HVCI is the Core Isolation setting our spoofer needs turned off, so if you're spoofing, the boot-time driver is the one you'll be dealing with.

That's why a Valorant HWID spoofer and an EAC spoof aren't interchangeable. If Vanguard reads your serials before the spoof is in place, it has already seen the real ones, and disk serials and MAC addresses alone won't hide a TPM-level identity. A Valorant spoofer bolted onto an EAC tool can look complete on paper and still get you banned again in your first match.

Our HWID spoofer line covers Valorant hardware bans. The banned Riot account stays banned, though, because the spoof clears the machine and nothing else.

Fortnite HWID spoofer: Epic's double ban and the clean Windows requirement

Get banned in Fortnite and you usually end up with a marked PC and a dead Epic account: EAC flags the hardware, Epic kills the login. A Fortnite spoofer fixes the PC, but the old account stays banned and you'll be playing on a different one.

Our Fortnite HWID spoofer currently requires a fresh Windows install on the drive you'll play from, and we'd rather you hear that now than halfway through setup. EAC on Fortnite doesn't stop at hardware serials. It also keys off residue tied to the Windows install itself, such as install-level identifiers and leftover Epic and EAC files, so spoofing on top of an install a ban has already seen carries that history forward.

Back up anything you want to keep before you wipe the drive, then follow the manual to set up the HWID spoofer Fortnite will run alongside.

If you play tournaments, Epic's Secure Boot, TPM and IOMMU requirement applies to your PC whatever the spoof does. Our spoofer works with Secure Boot enabled, so meeting that requirement doesn't lock you out of spoofing.

Warzone, Rust, Apex and Tarkov: what spoofing does on each anti-cheat

The spoof itself runs the same way on all of these. What changes from game to game is what else the ban took with it.

Warzone and Black Ops (Ricochet)

Ricochet bans the Activision account and records the hardware behind it. A Warzone HWID changer gives the PC a new identity, so your next Activision account isn't linked straight back to the old one.

Rust and Apex Legends (Easy Anti-Cheat)

Rust bans show up as a game ban on your Steam account, and EAC is widely reported to flag the hardware as well. A Rust spoofer covers the PC, but you'll need the game on another Steam account. Rust players also love carrying old cheat folders across installs, which is what the Clean step is for. Apex is simpler: spoof, then a new EA account.

Tarkov, DayZ and Rainbow Six Siege (BattlEye)

BattlEye bans usually land on the account, with a hardware record reported to sit alongside them. Tarkov hurts most because the license lives on the account, so you're buying the game again on top of the spoof. DayZ and Siege bans take the account with them too.

Battlefield 6 (EA Javelin)

Same drill as Ricochet: spoof first, then a different EA account.

What a hardware spoofer can't do, even when it works perfectly

A spoofer can't unban an account. The ban record lives on the publisher's servers, attached to your login, and nothing you do to your hardware touches it. Bans tied to your IP address or a phone number are outside its reach too, so if a game links accounts through phone verification, the number you used last time can still be flagged.

Some hardware is a poor fit. Laptops with soldered parts and some OEM boards from prebuilt brands can lock down the firmware a permanent spoof needs to rewrite, and you can't fall back on swapping a component.

Our spoofer won't run with a hypervisor enabled, either, which rules out pairing it with a hypervisor-based cheat. Core Isolation and Exploit Protection need to be off, and antivirus and firewall should be disabled while it runs.

Nor will a spoof protect you from repeating whatever got you banned. Reinstall the same detected cheat afterwards and the anti-cheat will flag the new identity the same way it flagged the old one.

Free HWID spoofers and the mess they tend to leave behind

Search for a free HWID spoofer and you'll find GitHub repos and forum drops promising a one-click unban. You'll also find a run of Microsoft Q&A threads from people who spoofed and then couldn't undo it. What they describe is less dramatic than a dead PC and more annoying: Windows suddenly isn't activated, Netflix and Disney+ refuse to stream, game cutscenes won't play, a drive vanishes from Explorer, and the original serials won't come back.

Some free downloads aren't spoofers at all, just keyloggers and account stealers with a spoofer's name on them, and you've handed them administrator rights. Others are genuine but careless, writing random data into SMBIOS or EFI variables without recording the originals, so when something breaks there's nothing to restore.

Even a decent free driver dies fast once it's public, because anti-cheat vendors can fingerprint the driver itself. That's the bigger difference with a maintained, paid driver: it isn't sitting in a public repo for anti-cheat teams to study, so it gets patched when they update, and its seed-based values hang together like real hardware. In temp mode a reboot also brings your real serials back, though Windows activation can still notice what happened while the spoof was running.

Nobody can promise that an undetected HWID spoofer will stay that way, because anti-cheats ship updates too. When we call one of our builds undetected, we mean it's clean against the current anti-cheat version and someone is actively maintaining it.

Getting started with an HWID spoofer at SkyCheats

We've run SkyCheats since 2018, and every HWID spoofer and HWID changer we sell is developed in-house and runs at kernel level. Between them, our builds cover all versions of Windows 10 and 11, games running EAC, BattlEye, Ricochet and EA Javelin, and Valorant.

Which is the best HWID spoofer? That depends on which anti-cheat banned you and what hardware you're on. The HWID Spoofer category lists our current builds so you can match one to your game.

Keys come in 1-day, 1-week and 1-month lengths, so you can test with a day before committing to a month. Delivery is instant once payment goes through.

Loader accounts are hardware-locked, so register on the PC you're actually going to spoof, not on a laptop or a friend's machine.

Manuals cover the setup, and support is available 24/7. To see how it's gone for other players, read the reviews from real players on our forum. And once your PC is back in the clear, our Valorant cheats and Fortnite cheats pages are the next stop if either is the game you're returning to.

HWID Spoofer FAQ

What is a HWID?

HWID is short for hardware ID: the serials and identifiers your PC's parts report, such as the drive serial, motherboard UUID, MAC address and, on newer systems, TPM values. There's no single HWID number. Anti-cheats combine these values into a fingerprint of your machine, and an HWID ban is filed against that fingerprint rather than your account, which is why it follows the PC.

What is a HWID spoofer?

It's software that feeds anti-cheats substitute hardware identifiers in place of your real ones. Most people reach for one after a hardware ban, so the same PC can come back under a new identity, but some run one before they're ever banned to keep their real serials out of any record. Serious ones work through a kernel driver and build every value from a single seed.

Is a HWID changer the same as a HWID spoofer?

Mostly, yes. Sellers, us included, use both names for tools that change the identifiers anti-cheats read. Where people do draw a line, an HWID changer rewrites the stored values, like a permanent spoofer, while a spoofer fakes them at read time and leaves the originals alone. That difference matters for Windows activation, which a permanent change is more likely to disturb.

How does a HWID spoofer work?

A kernel-level spoofer loads a driver at ring 0, the same level anti-cheats run at, and intercepts requests for hardware identifiers. The anti-cheat gets substitute values generated from a seed, so the fake identity stays consistent. Temporary spoofers do this at read time only, while permanent ones rewrite the stored values.

How do I check my HWID?

You check the pieces one at a time. In Windows PowerShell, Get-WmiObject Win32_DiskDrive | Select-Object SerialNumber lists drive serials, wmic csproduct get uuid shows the SMBIOS UUID, and getmac lists MAC addresses. Newer Windows 11 builds have dropped WMIC, so use Get-CimInstance Win32_ComputerSystemProduct | Select-Object UUID there instead. Write the values down before you spoof, so you know what your real ones are.

How do I change my HWID?

Editing the registry won't do it, because modern anti-cheats read hardware directly through their own kernel drivers. Your realistic options are replacing every part the ban recorded, which gets expensive fast, or using a kernel-level spoofer that covers disk, SMBIOS, network, EFI, GPU and monitor identifiers, paired with a cleaner for old traces.

Is a HWID spoofer permanent?

It depends on the type. A temporary spoofer swaps values at read time and everything reverts when you reboot, so you run it before each session. A permanent HWID spoofer rewrites the stored values so the new identity survives restarts, but it's harder to undo if Windows activation complains afterwards. Which one fits comes down to how you use your PC.

Does reinstalling Windows remove a hardware ban?

No. A reinstall clears software traces like registry keys, logs and old cheat files, but disk serials, the SMBIOS UUID and TPM identifiers live in hardware and firmware, so they don't change. A clean install is useful alongside a spoof, but on its own it leaves the HWID ban exactly where it was.

Will a HWID spoofer damage my PC?

A well-built one shouldn't harm the hardware. Temporary spoofing writes nothing to firmware, and a reboot brings your real serials back. The side effects people actually report are software: Windows activation and streaming DRM check your hardware too, so they can trip while the PC reports different serials, and after a permanent spoof they may not sort themselves out. Free tools that write random data to SMBIOS or EFI variables are far riskier.

Does Rust or Tarkov HWID ban?

Both are widely reported to. A Rust ban appears as a game ban on your Steam account, and Easy Anti-Cheat is said to record the hardware as well, so you'd need the spoof plus Rust on another Steam account. Tarkov's BattlEye bans take the account, and the account holds your game license, so it's a spoof, a new account and a new copy of the game.

Does a HWID spoofer work for Valorant and Fortnite?

Yes, with different caveats. Vanguard starts with Windows by default, which makes Valorant the harder of the two, and our line supports it. Fortnite needs a clean Windows install on the drive you play from, plus a new Epic account, because Epic bans the account too and EAC also keys off install-level residue.