Is Steam idling VAC safe?

What VAC is for

VAC bans are issued when Valve's anti-cheat detects cheat software while you are connected to a VAC-secured server: aimbots, wallhacks, memory editors, that kind of thing. The ban is tied to the account and cannot be lifted. Steam Support's own VAC pages describe it exactly that way, and Valve has said for years that leaving a game running is not a bannable offence in itself.

Idling does none of what VAC looks for. It touches no game files, injects nothing into a game process and joins no server. In the hosted model it does not even run the game: the session tells Steam a game is open, and Steam counts the time.

What can actually get you banned

Three things, and idling is not among them:

• Cheat software, in any VAC-secured game, on any account you sign into. This is what VAC exists for.
• Game-specific rules. Some multiplayer games punish players who sit AFK inside their own servers to farm rewards; that is the game's rule, not VAC, and a hosted idler that never joins a server never meets it.
• The Steam Subscriber Agreement forbids selling accounts and using unauthorised programs to gain an advantage in multiplayer. Adding playtime is not an advantage in a match.

Trading cards, badges and levels

Cards drop from playtime, and idling is playtime. Farming them this way has been common since 2013 and tools built for it are among the most popular open-source Steam projects. Steam has never treated it as cheating.

Where the real risk is: your credentials

The account-losing stories are not about VAC. They are about a password given to a service that stored it badly, or a Steam Guard secret exported from a phone so a tool could log in on its own. Once someone has both, they have the account.

So the question to ask a service is not “is idling safe?” but “what do you hold?”. The good answer is a session token obtained by scanning a QR code with the Steam app: your password is never typed, Steam Guard stays on, and you can cut the access yourself from Steam → Settings → Security → Authorized devices. That is how idlr signs in, and it is the one thing we ask you to look for in anyone else.

What idlr does, precisely

Our servers report your chosen games as running through a session you opened with a QR code. No game files, no servers joined, no cheats, nothing installed on your machine. When you launch a game yourself, the session steps aside within seconds and comes back when you stop. The token can be revoked from Steam at any time, and our terms say the rest in plain words, including that idling may clash with a particular game's own rules and that you use it at your own risk.