Co Browsing Access Code Pop-Up: How It Works in Practice

A co-browsing access code pop-up is a small overlay that appears on a customer's browser when a support session begins. It displays a short numeric code the customer reads to an agent, who enters it to connect. The pop-up is triggered by the customer, lasts only minutes, and always asks for explicit consent before any screen sharing starts. This guide walks through every stage of that flow, from code generation to session end, and explains how to tell a legitimate co-browsing prompt apart from a scam one.

What Is a Co-Browsing Access Code Pop-Up and Why Does It Appear?

A co-browsing access code pop-up is a browser overlay that starts a secure, shared browsing session between a customer and a support agent. The customer sees a short numeric code on their screen, reads it to the agent over chat or voice, and the agent uses it to connect. Nothing happens without that exchange.

The pop-up appears because co-browsing uses a code as a security handshake. The code proves the customer is present, willing, and the one who started the session. Without it, an agent could not join a stranger's browser uninvited.

Co-browsing is different from full screen sharing. Screen sharing tools broadcast everything on a device, including other browser tabs, desktop files, and any application the user has open. Co-browsing is limited to a single browser tab or a specific website. The agent sees only what the customer is doing on that page, nothing else.

That distinction matters when you are deciding whether a pop-up is safe. A legitimate co-browsing prompt appears after you take a deliberate action, such as clicking a "Get Help" button or a co-browse link in a chat window. It does not appear on its own.

Scam pop-ups behave differently. A fake "Trojan virus detected" alert or a fraudulent support prompt appears without any action on your part, often on a website you did not intend to visit. It typically creates urgency, asks you to call a phone number, or tries to push you toward downloading software. A genuine co-browsing access code pop-up never asks you to download anything, never displays a phone number to call, and never claims your device is infected. It shows a code, nothing more.

If a pop-up appeared without you clicking anything related to a support session, treat it as suspicious and close the tab.

How the Co-Browsing Access Code Pop-Up Works: Step by Step

The full session flow from the first click to an active shared view takes less than a minute when everything works correctly. Each stage is listed below in order.

1. The customer starts the process. You click a clearly labelled trigger on the company's website, such as a footer link or a "Generate Co-browse Code" button. This action is always yours to take. The session cannot begin without it.

2. The access code pop-up appears. A small overlay displays a unique numeric code, typically six or seven digits. Platforms handle this slightly differently: Cobrowse.io uses a 6-digit session code flow, while Upscope generates a 4-digit code that a customer can also produce by pressing the Ctrl key five times. The code is single-use and short-lived.

3. You read the code to the agent. You share the code verbally over a phone call or by typing it into a chat window. The agent does not see your screen yet. Nothing is shared at this point.

4. The agent enters the code. The agent types the code into their co-browsing platform dashboard. In Cobrowse.io's flow, the consent screen appears on your side only after the agent enters the code. The agent is waiting, not watching.

5. A consent pop-up asks for your permission. Before any view of your browser opens, a second prompt appears on your screen asking you to allow or accept the session. This is a separate step from the code exchange. You can decline here without any consequence.

6. You grant permission and the session goes live. Once you click Allow, the agent can view the browser page you are on. Depending on what the platform and the company have enabled, the agent may also be able to highlight elements, annotate the page, or take remote control to guide you directly.

On Chrome: The co-browsing access code pop-up works in Chrome without any plugin. Chrome may block the pop-up if your settings treat all pop-ups as spam. The section below on allowing pop-ups covers how to fix that.

On Android: The co-browsing access code pop-up on Android follows the same flow in a mobile browser. Cobrowse.io's SDK supports web and mobile apps, so the 6-digit code and consent screen appear in a mobile Chrome or Safari session the same way they do on desktop. The main difference is screen size: the pop-up renders as a mobile overlay rather than a desktop modal.

One important note from Cobrowse.io's documentation: 6-digit codes should not be generated on page load, because they expire shortly after creation. The customer should generate the code only when an agent is ready and waiting, not in advance.

How Long Does a Co-Browsing Session Code Last Before It Expires?

Code expiry varies by platform. There is no single industry standard. The table below shows expiry windows from four different vendors, based on their own documentation. Treat these as platform-specific examples, not universal rules.

The range runs from about 2 minutes to 30 minutes depending on the vendor. Glance's short window of just over two minutes means you need an agent ready before you generate the code. Blitzz's 30-minute window gives more flexibility, but the code is still single-use.

If your code expires before the agent connects, generate a new one and share it again. Most platforms make this a one-click action. Do not try to reuse an expired code; it will not work and may produce an error on the agent's side.

When a session ends mid-way, either because the customer navigated away or the connection dropped, some platforms hold the session open briefly. Glance, for example, keeps a suspended session alive for 10 minutes, giving the customer time to reconnect without starting over. Other platforms end the session immediately on disconnect and require a new code.

If you are on a support call and the session drops, ask the agent whether you need a fresh code or whether the session can be resumed. The agent's platform will tell them which applies.

What Happens After You Click Allow on the Co-Browsing Pop-Up?

Clicking Allow opens a live, one-way view of your browser tab for the agent. They can see exactly what you see on that page, including error messages, form fields, or navigation steps causing confusion. They cannot see other tabs, your desktop, or any other application.

Once the session is live, the agent can use several tools depending on what the company has enabled. Cobrowse.io supports annotation, highlighting, and remote control within the same session. Highlighting lets the agent draw attention to a specific button or field on your screen. Annotation lets them mark up the page so you can see exactly where to look. Remote control, when enabled, lets the agent click and type on your behalf, which is useful when a customer is stuck on a multi-step form or a complex checkout flow.

The agent cannot open new tabs, access your browser history, or navigate away from the page you are on without your browser following. If remote control is active, you can see every action the agent takes in real time. You stay in control: closing the tab or clicking an end-session button stops the session immediately.

What the agent sees is also shaped by data masking, which is covered in the next section. Sensitive fields like passwords or card numbers can be hidden from the agent's view even while the session is running.

Remote control is an optional capability that a company must explicitly turn on. If you are unsure whether your session includes remote control, ask the agent before you click Allow.

Data Privacy and Masking During a Co-Browsing Session

Co-browsing is more privacy-conscious than full screen sharing by design. The session is limited to a single browser tab or website, so the agent never sees your desktop, other open applications, or unrelated browser activity. That boundary is built into how co-browsing works, not something you have to configure yourself.

Beyond that structural limit, most co-browsing platforms add a second layer of protection called data masking. Cobrowse.io supports customisable data masking, which lets a company specify which fields on their own pages are hidden from the agent's view during a session. Common candidates include password fields, credit card numbers, social security numbers, and any field marked as sensitive by the site's developers. Those fields appear blank or redacted on the agent's screen even while the customer fills them in normally.

If a customer is completing a payment on a support call, the agent can guide them through each step without ever seeing the card number. The customer types it into a masked field, the page processes it, and the agent sees only that the field was completed.

The difference between co-browsing and screen sharing becomes most visible here. A screen-sharing session captures everything the operating system displays, including notification banners, other browser tabs, and any file or folder that appears on screen. Co-browsing captures only the shared tab, and masking removes sensitive fields from even that limited view.

The 2016 Aberdeen data cited by Cisco's blog found co-browsing achieved customer satisfaction ratings of 78% versus 47% for web self-service, and generated 4X more positive social media mentions. Those figures are nearly a decade old and should not be read as current benchmarks, but they point to a consistent pattern: customers respond better when an agent can see and guide them in context rather than asking them to describe a problem verbally.

Data masking configuration sits on the company's side, not the customer's. If you are concerned about what an agent can see, ask the support team before you click Allow. Any reputable company using a co-browsing tool should be able to tell you which fields are masked on their platform.

How to Allow a Co-Browsing Pop-Up in Your Browser

If the access code pop-up does not appear after you click the trigger on a company's website, your browser's pop-up blocker is likely the cause. Chrome on desktop and Chrome on Android both block pop-ups from unfamiliar sites by default.

On Chrome (desktop):

1. Look for a small icon in the address bar on the right side. It usually looks like a blocked window or a small "x". Click it.

2. Select "Always allow pop-ups and redirects from [site address]".

3. Click Done. The browser will reload the page.

4. Click the co-browse trigger again. The access code pop-up should now appear.

If you do not see that icon, go to Chrome Settings, then Privacy and Security, then Site Settings, then Pop-ups and redirects. Find the site under "Blocked" and move it to "Allowed".

On Android (Chrome mobile):

1. Tap the three-dot menu in the top-right corner of Chrome.

2. Go to Settings, then Site Settings, then Pop-ups and redirects.

3. Tap the site address if it appears under "Blocked", or add it manually under "Allowed".

4. Return to the support page and tap the co-browse trigger again.

The co-browsing access code pop-up on Android follows the same code-and-consent flow as desktop. The overlay appears as a mobile-sized modal rather than a desktop window, but the steps are identical.

Only allow pop-ups for sites you trust and where you have actively started a support session. Do not enable pop-ups site-wide, as that removes a useful layer of browser protection.

When a No-Code Co-Browsing Approach Removes the Pop-Up Entirely

Some co-browsing setups skip the access code step entirely. Instead of asking the customer to generate a code and read it aloud, the agent sends a link directly through the chat window. The customer clicks it, a consent prompt appears, and the session starts. There is no code to generate, no code to expire, and no risk of the pop-up being blocked.

This approach works well for support teams that already handle customer contact through a chat or messaging channel. The agent controls the invitation, so the session starts only when both sides are ready.

Auvious is a video calling and cobrowsing platform that embeds this kind of flow into existing contact centre tools, including Genesys Cloud, NICE, Talkdesk, Verint, Five9, and RingCentral. Agents escalate from a chat or voice call to a shared browser session in one click, without leaving their existing interface. Customers join from their browser with no app or plugin to install.

This model suits teams that want to reduce session-start friction and avoid the troubleshooting that comes with pop-up blockers. If your support volume is high and your agents already work inside a CX platform, embedding cobrowsing there removes the code exchange as a point of failure.

Prices and plan limits verified as of October 2026.

FAQs

How is co-browsing different from remote desktop or screen sharing?

Co-browsing limits the shared view to a single browser tab or website. Remote desktop and full screen sharing give the other party access to your entire screen, including all open applications, files, and notifications. Co-browsing agents can only see the page you are on. They cannot open other tabs, view your desktop, or access anything outside the shared session.

Can a co-browsing session access files on my computer?

No. Co-browsing is contained within the browser tab the session is tied to. The agent sees only what is rendered on that page. They cannot browse your file system, open applications, or view anything outside the active browser tab. Even if remote control is enabled, the agent can only interact with elements on the shared web page.

How do I know a co-browsing pop-up is legitimate and not a scam?

As described earlier, a legitimate co-browsing access code pop-up shows a numeric code and nothing else. It does not ask you to call a phone number, download software, or enter a password. If a pop-up appeared without any action on your part and creates urgency or asks you to install something, close the tab immediately.

How do I remove a malicious browser pop-up that looks like a co-browsing prompt?

Close the tab first. If the pop-up prevents you from closing it, use your browser's task manager or force-quit the browser entirely. Do not click anything inside the pop-up, including a close button, as some fake prompts use that click to trigger a download. Once the tab is closed, run a malware scan and check your browser extensions for anything you did not install yourself.

Can co-browsing work on a mobile browser without an app?

Yes. Platforms like Cobrowse.io support web and mobile browsers through an SDK, so the 6-digit code and consent flow appear as a mobile overlay in Chrome or Safari on Android and iOS. No app download is required. The session is contained to the mobile browser tab, the same way it works on desktop.

Conclusion

A co-browsing access code pop-up is a deliberate security step, not a browser threat. The customer generates the code, shares it with an agent, and grants consent before any view of their browser opens. The session is limited to a single tab, sensitive fields can be masked, and either side can end it at any time.

If you are setting up or troubleshooting a co-browsing session, start by checking whether your browser's pop-up blocker is preventing the code from appearing. On Chrome, allow pop-ups for the specific support site rather than disabling the blocker entirely. To avoid the code step altogether, look at agent-initiated or link-based cobrowsing tools that embed the session start directly into your existing support channel.