Every product page in this market is labelled external or internal, and almost none of them explain what that means. It describes where the code runs — and that single fact determines how good it feels, how it draws on your screen, and how likely it is to end your account.
Where the code runs
An external cheat is a separate program. It runs as its own process alongside the game, asks the operating system to read the game's memory, and never becomes part of the game itself.
An internal cheat is loaded into the game's own process. Its code lives in the same memory space as the game, which means it can read variables directly rather than asking Windows for them, and can call the game's own functions.
That is the whole distinction. Everything else — the aim quality, the visuals, the detection risk — follows from it.
A useful way to picture it: an external is someone reading over your shoulder, and an internal is someone sitting inside your head. The second knows more, faster. The second is also much harder to explain away if anyone checks.
How each one reads the game
An external asks the operating system for a handle to the game process and reads memory across the process boundary. Every read is a system call, which costs time — so an external samples: it reads positions, draws, and reads again a fraction of a second later.
That sampling gap is why external aim assistance feels corrective. It knows where a target was a moment ago and adjusts toward where it thinks they are, rather than tracking where they are right now.
An internal reads the same values as ordinary memory access, at the speed the game itself does, every frame. There is no gap to compensate for, which is why internal aimbots track smoothly and internal projectile prediction is exact rather than estimated.
For hitscan weapons this difference is small. For anything with bullet travel — Apex, Warzone at range, DayZ, Tarkov — it is the difference between prediction that works and prediction that misses.
How each one draws on your screen
An external cannot draw inside the game, so it creates its own transparent window and floats it on top. That works, and it is why external overlays sometimes flicker, sit wrongly in fullscreen, or vanish when you alt-tab.
It also has a side effect people like: because the overlay is a separate window, it can be excluded from screen capture, which is what streamproof means on an external.
An internal hooks the game's own rendering and draws through it. The ESP is part of the frame the game produced, so it never flickers, never misaligns, and behaves correctly in exclusive fullscreen.
The trade is that hooking the renderer means modifying how the game draws, which is precisely the sort of change an anti-cheat can look for.
What the anti-cheat can see
This is where the safety difference lives, and it is not subtle. A large part of what modern anti-cheat does is inspect its own process: enumerate loaded modules, check that its code has not been modified, look for hooks in functions it cares about, and scan for threads that should not exist.
An internal is inside that perimeter. Everything it does — being loaded, hooking the renderer, running its own thread — is the exact category of thing those checks exist to find.
An external sits outside it. The checks that catch injected code do not apply, because there is nothing injected. What remains is a narrower surface: the process handle it holds to the game, the pattern of its memory reads, and the process itself being present on the machine.
Anti-cheats do look at that surface — handle enumeration is a known technique — but it is a smaller and more ambiguous signal than a module sitting inside the game.
The failure modes differ too
When an internal breaks, the game usually crashes, because the broken code is part of the game. When an external breaks, the cheat closes and the game keeps running.
That matters more than it sounds on games with kernel anti-cheat, where a mid-match crash is itself a signal worth investigating.
Game updates break internals harder. An external reading a handful of memory offsets can often be patched quickly; an internal that hooks functions has more to fix when those functions change.
It also explains why internal builds tend to be down longer after a patch, which is worth knowing before you buy one on a game that updates weekly.
Which one to buy
For most people, on most games, an external on a throwaway account is the right answer. The performance gap is real but modest; the detection gap is not modest at all.
Buy an internal when the quality genuinely matters to how you play — projectile-heavy games where prediction decides fights, or when you want visuals that behave perfectly in fullscreen — and when the account and the hardware are both disposable.
Do not buy an internal on a game with permanent hardware bans unless you are running a spoofer and have accepted losing the machine's clean status. Valorant and Call of Duty are the obvious cases.
And if the answer to 'which is safer' matters more to you than either, the honest next step is neither: a DMA setup runs nothing on the gaming machine at all.
Frequently asked questions
Is an external cheat safer than an internal one?
Generally yes. Anti-cheats spend most of their effort inspecting their own process — loaded modules, hooks, unexpected threads — and an external is outside that perimeter entirely. It is safer, not safe.
Why does an internal aimbot feel smoother?
It reads the real game state every frame rather than sampling memory from outside, so there is no gap between what it knows and what is happening. Tracking follows rather than corrects.
Why does my external overlay flicker in fullscreen?
Because it is a separate window drawn on top of the game rather than part of the frame. Borderless windowed mode usually fixes it; an internal does not have the problem at all.
Which one survives game updates better?
Externals, usually. They read offsets that can be updated quickly, while internals hooking game functions have more to repair when those functions change.
Can anti-cheat detect an external at all?
Yes. The process handle it holds, its memory access pattern and the program's presence on the machine are all visible. The surface is smaller and more ambiguous than an injected module, not absent.
Check before you buy
Live detection status for every product is on the status page, updated automatically from our supplier feed rather than by hand.
Every product page shows its own live status.
Read next
What Is a DMA Cheat and How Does It Work? — How DMA cheats read game memory over hardware from a second computer, why software anti-cheat cannot scan them, what a full setup costs, and who it is actually for.
Internal, External and DMA Cheats — What the Difference Means — How internal, external and DMA cheats actually differ, what each one costs you in detection risk, and which is the right choice for the account you are protecting.
How Anti-Cheat Detection Actually Works — What EAC, BattlEye and Vanguard actually look for, why 'undetected' is a moving target, and how detection waves work in practice.
