Every guide on this site tells you to make passwords long and random, and the advice holds - Against guessing. A keylogger doesn't guess. It sits between your keyboard and everything else, recording keystrokes as you type them, and it captures a 40-character masterpiece exactly as easily as 123456. That inversion is what makes keylogging worth understanding: it's the threat class where password strength buys you nothing, and where the effective defenses are architectural - Changing how credentials get entered, not what they contain.
What a keylogger actually is
A keylogger is any mechanism - Software or hardware - That records keyboard input, usually silently, usually for delivery to someone else. The category spans a surprising range of legitimacy: employee-monitoring suites and parental-control apps ship keylogging as a feature, while criminal keyloggers ship inside malware. The mechanics are identical; only the consent differs.
Modern criminal keylogging rarely arrives as a standalone tool anymore. It's bundled as one module inside broader credential-stealing malware families, alongside clipboard capture (grabbing what you copy and paste), screenshot capture, and wholesale theft of browser-stored passwords and session cookies. The Verizon Data Breach Investigations Report has for years put stolen credentials among the leading causes of breaches - And keystroke capture is one of the workhorse ways those credentials get stolen in the first place.
How software keyloggers work
Software keyloggers exploit a simple fact: operating systems deliver keystrokes through well-defined channels, and programs can subscribe to them.
- API hooks. On Windows, an application can register a hook that observes keyboard events system-wide. This is the classic technique - The same plumbing that lets a hotkey utility work lets a logger listen.
- Kernel-level loggers. More sophisticated variants install a driver that intercepts input below the operating system's user layer, which makes them far harder for security software to spot.
- Browser and form grabbers. Rather than logging raw keystrokes, these hook the browser and capture form fields as they're submitted - Neatly packaging your username, password, and destination site together, and defeating tricks like typing your password out of order.
- Web-based skimmers. A malicious script injected into a compromised website can log what you type into that page. Nothing is installed on your machine at all; the page itself is the logger.
Delivery is unglamorous: phishing attachments, fake installers, cracked and pirated software, malicious browser extensions, poisoned ads. In other words, keyloggers arrive the way all malware arrives, which is why the defenses overlap so heavily with general phishing protection.
Hardware keyloggers: rare but real
A hardware keylogger is a physical device - Typically a small plug that sits inline between a keyboard and the computer, or circuitry hidden inside a keyboard. Some log to internal memory for later pickup; pricier ones transmit over WiFi. There are even research-grade attacks that infer keystrokes from acoustics or electromagnetic emissions, though these are of little concern to ordinary people.
The practical risk profile is narrow: shared and public computers (hotel business centers, libraries, internet cafés), workplaces with a malicious insider, and targeted attacks against specific individuals. You will probably never encounter one on your own laptop. The lesson is not to inspect your USB ports nightly - It's to treat any computer you don't control as compromised by default and never type important credentials on one.
Assume any keyboard you don't own is hostile. Log in on your own device instead - Or if you truly must use a public machine, change that password from a trusted device as soon as you're done.
Software vs hardware at a glance
| Software keylogger | Hardware keylogger | |
|---|---|---|
| Typical delivery | Phishing, fake installers, cracked software, malicious extensions | Physical access to the machine |
| Scale | Mass campaigns, thousands of victims | One machine at a time |
| Captures | Keystrokes, clipboard, screenshots, stored browser data | Keystrokes only |
| Detected by | Antivirus/EDR, unusual process behavior | Visual inspection only |
| Survives OS reinstall | No | Yes |
| Realistic risk for most people | The dominant threat | Low, outside shared computers |
Defenses that actually work
The goal is layered: make infection unlikely, make captured keystrokes useless, and make stolen credentials insufficient.
Stop the infection. Keep the operating system and browser updated, don't install cracked software, be skeptical of email attachments, and audit browser extensions ruthlessly - They run with enormous privilege. Built-in protections like Microsoft Defender catch the bulk of commodity malware; let them run.
Take the keyboard out of the loop. A password manager's autofill enters credentials without keystrokes, so a classic keylogger records nothing. This is an underrated argument for using one: our Password Wallet stores encrypted credentials and fills them without you typing a character. (A full infostealer that raids browser storage can still win - No single layer is total - But autofill defeats the entire keystroke-capture class.) When you create credentials, generating them with a password generator and saving them directly to the manager means the password is never typed at all, on any machine, ever.
Make captured passwords insufficient. Two-factor authentication is the great blunter of keyloggers: the attacker gets your password but still can't log in without the second factor. App-based TOTP codes - The six-digit rotating codes from an authenticator app - Expire within about 30 seconds, so even a logged code is nearly worthless by the time it's exfiltrated and replayed. Setup takes minutes; the two-factor authentication guide walks through it. Phishing-resistant options like hardware keys and passkeys go further still, since they never produce a typeable secret in the first place.
Signs of infection - And what to do
Commodity keyloggers are designed to be invisible, so don't expect the clichés of a slow computer and a hot fan. The more reliable signal is downstream: a login alert from a service you didn't touch, a password that stops working, or your email address surfacing in a breach-notification service like haveibeenpwned.com paired with a password only you knew.
If you suspect an infection, sequence matters:
- Clean first. Run a full scan with your OS's built-in security tools or a reputable scanner; if anything serious turns up, back up your files and reinstall the operating system. A reinstall is the only certain cure for kernel-level malware.
- Then change passwords - From a different, trusted device. Changing them from the infected machine hands the new ones straight to the logger. Prioritize email, banking, and your password manager.
- Revoke sessions and check recovery settings. Attackers who used stolen cookies may still be logged in after a password change; use each service's "sign out everywhere" option and confirm no forwarding rules or recovery emails were added. The full checklist lives in what to do after a data breach.
- Enable 2FA everywhere it was missing. That's the layer that would have contained the damage.
Keylogging is one branch of a bigger tree - Credential theft - And it's worth seeing the whole tree once: how hackers crack passwords covers the guessing side that keyloggers let attackers skip.
FAQ
Can a keylogger steal passwords my browser autofills?
Classic keystroke capture can't, since autofill generates no keystrokes - That's a genuine defensive win. But full-featured infostealer malware also raids the browser's saved-password store and cookies directly, which is why dedicated password managers with a locked, encrypted vault are safer than bare browser storage, and why 2FA still matters as the layer behind everything.
Do keyloggers exist on phones?
Yes, though the economics differ. Mobile keylogging usually arrives via sideloaded apps, malicious custom keyboards, or abuse of accessibility permissions rather than classic hooks. Sticking to official app stores, refusing accessibility access to random apps, and not sideloading covers the overwhelming majority of the risk on both Android and iOS.
Will antivirus catch every keylogger?
No single tool catches everything - Kernel-level and freshly compiled variants evade signatures for a while. Real-world defense is probabilistic: updated software plus built-in antivirus stops most commodity attacks, autofill neutralizes keystroke capture, and 2FA limits the damage when something slips through. Stack the layers rather than trusting any one.
Are employer monitoring tools keyloggers?
Functionally, often yes - Many workplace-monitoring and parental-control products record keystrokes, and doing so on company-owned hardware is generally legal with disclosure (laws vary by jurisdiction). The practical takeaway: never log in to personal accounts on an employer's machine, and treat work devices as monitored by default.
Someone had physical access to my computer. Should I worry?
Brief casual access is low risk; sustained access by someone motivated is a real concern, since physical access enables both hardware loggers and software installs. If it's plausible you were targeted - Say, by an abusive partner, which is sadly the common real-world case - Check for unfamiliar devices inline with the keyboard, review installed programs and browser extensions, and consider a clean OS reinstall followed by password changes from a separate device.