A keylogger records every keystroke you type — including passwords, credit card numbers, personal messages, and search queries — and sends that data to an attacker. It's one of the most direct attacks on your credentials because it bypasses encryption entirely: by the time you type a password, it's already been captured in plaintext before any encryption happens.
What is a keylogger?
A keylogger (keyboard logger) is software or hardware that monitors and records keyboard input. They fall into two main categories:
Software keyloggers
Software keyloggers run as processes on your operating system, hooking into keyboard APIs to intercept keystrokes before they're processed by applications. Types include:
- API-level keyloggers — Use OS API hooks (like SetWindowsHookEx on Windows) to intercept keystrokes globally across all applications.
- Kernel-level keyloggers — Operate at a deeper OS level, harder to detect by user-mode security software.
- Browser-based keyloggers — Malicious JavaScript on compromised websites that captures input in form fields. Limited to that specific page.
- Form grabbers — Intercept data submitted through web forms before it's encrypted by HTTPS — specifically targeting login credentials.
- Acoustic keyloggers — Record the sound of keystrokes and use machine learning to reconstruct what was typed based on the distinctive sound of each key.
Hardware keyloggers
- Inline USB keyloggers — Small devices that plug between a keyboard and a USB port, recording all keystrokes to internal storage. Completely invisible to software.
- Keyboard overlay keyloggers — Fake keyboard overlays placed over ATM or point-of-sale keypads to capture PINs. A form of card skimming.
- Wireless keyboard sniffers — Capture and decode the unencrypted radio signals from wireless (non-Bluetooth) keyboards.
How software keyloggers are installed
Malware delivery via email
Phishing emails with malicious attachments (Word documents with macros, executable files disguised as PDFs) install keyloggers when opened.
Drive-by downloads
Visiting a compromised website triggers exploitation of browser or plugin vulnerabilities, silently installing malware including keyloggers.
Trojanized software
Pirated software, cracked games, or fake software installers bundle keyloggers with the legitimate application. This is extremely common on piracy sites.
Physical access
Someone with brief access to your unlocked computer (at home, in an office, at a hotel business center) can install a keylogger manually.
Remote access exploits
Attackers who gain remote access to your system through other vulnerabilities can deploy keyloggers as part of a broader attack.
Signs your device may have a keylogger
- Unexplained slowdowns or CPU usage spikes
- Unusual network activity (keyloggers transmit captured data)
- Browser or application crashes more than usual
- Unexpected account logins or password change notifications
- Antivirus detecting "suspicious" processes
Note: many professional keyloggers are designed to be completely invisible and use minimal resources. Absence of these signs doesn't mean your device is clean.
How to detect keyloggers
- Task Manager / Activity Monitor — Review running processes. Look for unfamiliar processes, especially ones running as SYSTEM or with high CPU/network usage.
- Antivirus/antimalware scans — Run a full system scan with updated definitions. Malwarebytes is particularly effective for keyloggers and PUPs.
- Network monitoring — Tools like Wireshark or Little Snitch (macOS) show all outbound connections — unusual destinations sending data may indicate exfiltration.
- Physical inspection — Check USB ports and keyboard connections for inline hardware keyloggers, especially on shared or public computers.
How to protect against keyloggers
Use a password manager
Password managers autofill credentials without you typing them — bypassing most software keyloggers. Form grabbers that target the browser's autofill mechanism are an exception, but this is rarer and more targeted.
Enable two-factor authentication (2FA)
Even if a keylogger captures your password, a TOTP code (from an authenticator app) or hardware security key (YubiKey) prevents the attacker from using it. Time-based codes expire in 30 seconds. Hardware keys require physical presence.
Keep software updated
Software keyloggers often exploit vulnerabilities in browsers, plugins (Flash, Java, PDF readers), and operating systems. Patching eliminates the attack surface for drive-by installations.
Don't use untrusted computers for sensitive accounts
Public computers (library, hotel business center, internet café) may have hardware or software keyloggers. For sensitive accounts (banking, email), use your own device or a VPN on your phone's mobile data.
Use on-screen keyboards for critical inputs (limited effectiveness)
On-screen keyboards (clicking letters on a virtual keyboard) defeat simple keyboard API hooks, but are still vulnerable to more sophisticated keyloggers that capture screenshots or mouse click positions. Not a reliable defense — 2FA is more effective.
Frequently asked questions
Does HTTPS protect against keyloggers?
No. HTTPS encrypts data between your browser and the server, but a keylogger captures your keystrokes before they leave your device — before any encryption occurs. A keylogger sees your password in plaintext regardless of whether the site uses HTTPS.
Can a phone have a keylogger?
Yes. Mobile keyloggers disguise themselves as legitimate apps and abuse Android's Accessibility Services or iOS's MDM (Mobile Device Management) features to capture input. Stick to apps from official stores, review permissions carefully, and never sideload apps from unknown sources. On iOS, keyloggers are far more constrained due to the sandbox model.
What's the most effective defense against keyloggers?
A combination of: (1) keeping software updated to eliminate drive-by installation vulnerabilities, (2) using a password manager to minimize manual typing of credentials, (3) enabling TOTP-based 2FA so captured passwords alone aren't sufficient for account access, and (4) running reputable antimalware software with real-time protection.