What Is a Keylogger? Types, Detection & How to Stop It

A keylogger is software or hardware that secretly records every keystroke you type, passwords, card numbers, private messages, and quietly ships that data to whoever installed it. Most are malware spread through phishing or booby-trapped downloads, but some are legal monitoring tools. What makes one a threat isn’t the technology. It’s intent and consent.

I’ve spent enough time triaging compromised endpoints to tell you the scary part about keyloggers isn’t how clever they are. It’s how boring they are.

A good one does nothing flashy. No ransom note, no locked screen. It just sits there, logging, for weeks, and by the time anyone notices, the attacker already has the bank login, the email password, and the corporate VPN credentials. Silence is the whole point.

What Is a Keylogger, Exactly?

A keylogger, short for “keystroke logger”, is a type of spyware that captures keyboard input and records it for someone else to read. The keylogger monitors each key as it’s pressed, stores the sequence, and then transmits the log to an attacker, typically through a remote command-and-control (C&C) server.

Here’s the thing most people miss: a keylogger doesn’t need to break into your bank to ruin your week. It just needs to watch you log in. Once it has your username and password, for email, especially, it has the master key. Email is where password resets land.

Compromise the inbox and an attacker can walk into every other account you own. That’s why credential theft via keylogging is a foundational step in so many larger breaches, from account takeover to full-blown ransomware.

The term goes back further than most people assume. Intelligence agencies were bugging electric typewriters to capture keystrokes back in the Cold War era, long before the consumer PC existed. The hardware got smaller and the software got nastier, but the core idea, sit between the key and the screen, record everything, hasn’t changed in fifty years.

How Do Keyloggers Actually Work?

Every keylogger lives in the same gap: the moment between when a key is depressed and when that character shows up on your monitor. Whoever controls that gap controls the data. There are several ways to occupy it, and the method determines how hard the thing is to catch.

Software keyloggers are the common case, applications or scripts installed on the target machine. Once running, they intercept input using one of a few techniques:

• Keyboard hooks. The keylogger uses a system hook to grab each keypress notification before it reaches the application you’re typing into, then writes it to a hidden log. This is the classic approach.
• Kernel-level logging. More advanced variants burrow down into the operating system kernel, replacing or filtering the keyboard driver. Operating at this depth gives them broad access and makes them genuinely hard to spot, because they sit below the tools you’d normally use to find them.
• API and DLL interception. Some hook into shared library functions (like a DLL many programs rely on) to capture input that way.
• Periodic exfiltration. The captured data gets bundled up and pushed to an attacker-controlled server on a schedule, so the attacker never needs to touch the device again.

Hardware keyloggers skip software entirely. They’re physical, a small inline device plugged between the keyboard and the USB port, a bug hidden inside the keyboard’s circuitry, or even a tampered cable.

They record keystrokes as the signal travels to the computer, before the OS ever sees it, which means antivirus on the machine is blind to them. The trade-off for the attacker: they need physical access to plant the device, and usually to retrieve it (though some newer ones exfiltrate over Wi-Fi).

Then there are the edge cases that show real-world creativity. Video-surveillance “keylogging,” where a camera films the keyboard and login screens so the attacker can replay and read the keys. Acoustic attacks that analyze the distinct sound each key makes.

On phones, there are no hardware keyloggers in the usual sense, but software ones capture screen taps, virtual-keyboard presses, screenshots, and microphone input, often more invasive than their desktop cousins.

Software vs. Hardware Keyloggers: The Short Version

Factor	Software Keylogger	Hardware Keylogger
Installation	Remote, phishing, malicious download, Trojan	Requires physical access to the device
Spreads to other devices?	Yes, can propagate like other malware	No, one device per device
Detected by antivirus?	Often, unless kernel-level/rootkit	No, invisible to on-machine software
Captures beyond keys?	Yes, screenshots, clipboard, mic, camera	Usually keystrokes only
Data retrieval	Automatic, over the network	Often manual; sometimes over Wi-Fi
Best defense	Security software, patching, MFA	Physical inspection of ports and cables

If you run an office, that last row matters more than people think. A hardware keylogger planted on a shared or public machine can quietly collect days or weeks of logins before anyone touches a bank or brokerage account on it. Who has physical access to your endpoints is a real part of your threat model.

How Do Keyloggers Get on Your Device?

Nearly all software keylogger infections trace back to a handful of delivery methods, and none of them are exotic:

• Spear phishing. A targeted email or link, often spoofed to look like it’s from a colleague, friend, or vendor. You click, the keylogger installs. This is the single most common entry point I see.
• Drive-by downloads. You visit a compromised website and the malware installs in the background without a single click of confirmation.
• Trojan horses. The keylogger rides along inside something that looks legitimate, a cracked app, a “free” tool from an unofficial site, a bundled installer. The Greek-myth namesake is apt: the gift is the attack.
• Malicious attachments. The same logic as phishing, delivered through a file instead of a link.

The uncomfortable truth is that the human is the vulnerability here, not the machine. If you want the technical hygiene that prevents most of this, our guide to computer virus prevention covers the habits that actually move the needle.

Are Keyloggers Always Illegal?

No, and this trips people up. Keyloggers occupy genuinely gray legal territory because the same tool can be a crime or a legitimate product depending on who installs it and why.

Install a keylogger on a device you own, with the informed consent of the people using it, and it’s generally legal. Employers use monitoring software to investigate insider threats or data theft; IT teams use it to troubleshoot; parents use it for child safety. Ethical hackers and penetration testers use keyloggers during authorized security assessments. The line is ownership, consent, and intent.

Cross that line, install one secretly on someone else’s device to steal data, stalk a partner, or spy on a competitor, and you’re into clear criminal territory in most jurisdictions, with privacy laws like the GDPR, HIPAA, and CCPA adding regulatory teeth on top.

My honest take: if you’re an employer or parent considering monitoring software, the legal exposure usually comes from secrecy, not the tool. Disclose it. Document consent. The covert route is where organizations get sued.

How to Detect a Keylogger (and Why the Common Advice Is Half-Wrong)

Most articles tell you to open Task Manager, look for a weird process, and call it a day. That advice isn’t wrong so much as dangerously incomplete, because the keyloggers worth worrying about are specifically built to not appear there.

A kernel-level or rootkit keylogger hides below the process list. If checking Task Manager came up clean, that is not an all-clear.

That said, here’s a realistic detection checklist, weakest signal to strongest:

1. Performance and behavior changes. Sudden sluggishness, typing lag (a keylogger sitting in the input path can introduce a delay between keypress and character), random freezes, or unexpected pop-ups. These are hints, not proof, low RAM causes the same symptoms.
2. Unfamiliar processes and startup items. Check Task Manager (Windows) or Activity Monitor (Mac) for processes you don’t recognize, then look at the Startup tab, keyloggers want to launch with the OS. Search any name you don’t know before you panic or before you disable it.
3. Browser extensions. Malicious extensions are a sneaky logging vector. Review what’s installed in Chrome, Firefox, Safari, and Edge, and remove anything you don’t remember adding.
4. Outbound network traffic. This is a stronger signal. A keylogger has to phone home eventually. A firewall or network monitor showing steady data going to an unfamiliar IP address is worth investigating hard.
5. A full scan with reputable security software. This catches the majority of known software keyloggers, and unlike eyeballing process lists, it’s checking against actual threat signatures and behavior.
6. Physical inspection. For hardware keyloggers, nothing software does will help. Look at the back of the machine, the USB ports, and the keyboard cable for anything you don’t recognize, especially on shared or public computers.

Don’t use the process-list method alone if anything is genuinely at stake. If you handle sensitive data and have real reason to suspect compromise, get a professional to image and examine the machine. Self-diagnosis has limits, and the stealthiest keyloggers are designed to beat exactly the checks above.

How to Protect Yourself From Keyloggers

There’s no single switch that makes you immune. Defense against keyloggers is about stacking layers so that no single failure hands over everything.

• Run reputable security software and keep it updated. Antivirus plus a firewall catches and blocks most software keyloggers and flags suspicious outbound traffic. On the enterprise side, Endpoint Detection and Response (EDR) adds behavioral detection for the stealthier variants.
• Use a password manager. This one is underrated. A password manager auto-fills credentials, so you’re not physically typing the password, a keylogger watching the keyboard captures nothing. It also generates unique, complex passwords so one stolen credential doesn’t unlock everything.
• Turn on multi-factor authentication everywhere. Here’s the honest nuance: MFA is your best safety net, because even a stolen password is useless without the second factor. But it’s not magic. Sophisticated attacks can steal session tokens after you authenticate, so treat MFA as critical, not bulletproof.
• Patch your OS and applications promptly. Keyloggers exploit known, unpatched vulnerabilities to install themselves. Closing those is some of the cheapest security you’ll ever do.
• Be ruthless about links, attachments, and downloads. Since phishing and bundled installers are the top delivery methods, skepticism is a genuine control. Stick to official sources. Don’t run cracked software, that “free” copy is the single most reliable way to invite a keylogger in.
• Watch the limits of virtual keyboards. On-screen keyboards can defeat keyloggers that only capture physical keystrokes. But, and this is the part vendors gloss over, many modern keyloggers also take screenshots or record screen taps, which neutralizes the trick. Useful as one layer, not a complete answer.
• Mind physical security. Periodically check hardware connections, particularly on public or shared machines, and control who has physical access to important devices.

For organizations, layer in email filtering (SPF, DKIM, DMARC to cut spoofing), least-privilege access, application whitelisting, and ongoing security-awareness training. The training matters most, people-centric defenses beat technical ones when the attack starts with a click.

The Bottom Line

A keylogger is a patient, quiet thief. It doesn’t need to be sophisticated to be devastating, it just needs to watch you type one password.

The good news is that the same boring discipline that stops most malware stops most keyloggers: don’t click sketchy links, don’t run pirated software, patch your stuff, use a password manager, and turn on MFA. Do those five things and you’ve shut the door on the overwhelming majority of keylogging attacks. The attackers are betting you won’t bother. Prove them wrong.

Frequently Asked Questions