Keylogger
Also known as: keystroke logger, keylogging, keystroke logging
A keylogger is software or hardware that secretly records keystrokes typed on a computer or phone, capturing passwords, messages, credit card numbers, and anything else.
Software keyloggers usually arrive as malware, while hardware keyloggers are small devices plugged between a keyboard and a computer. While keyloggers are a classic spying tool, multi-factor authentication and password managers that autofill credentials limit the damage they can do.
Keylogger, explained at three levels
At home
A keylogger is like someone hiding behind you with a notepad, writing down every key you press. It can be a hidden program, usually arriving with malware, that sees keystrokes before they reach your apps, or a tiny device plugged in between keyboard and computer. Either way, the log ends up with a criminal, who reads your passwords, messages, and card numbers from it.
At work
A keylogger is software or a small hardware device that secretly records every keystroke on a computer. On a work machine, that captures logins to banking, payroll, and confidential systems, plus anything typed in emails or documents, and passes it to an attacker. Businesses limit the damage with endpoint protection that spots keylogging behaviour and MFA, so a captured password alone can't open an account.
At home
A software keylogger hooks into the part of the operating system that receives keystrokes, so it sees each key before the app you are typing in does. It saves them to a hidden file and sends them to the attacker on a schedule. A hardware keylogger is a small adapter between the keyboard and the computer, or a modified keyboard, that stores keystrokes in its own memory. Neither needs to break anything; they simply listen.
At work
Keyloggers rarely work alone. They are usually one feature of a remote access trojan or infostealer that also grabs screenshots, clipboard contents and form fields. On Windows they rely on keyboard hooks, input APIs or browser extensions with permission to read pages. Endpoint protection flags these behaviours, while application control and removing admin rights stop many from installing. MFA, especially phishing-resistant methods, limits the damage, because a captured password alone no longer opens the account.
At home
On public computers, such as those in hotel business centres or libraries, you cannot know what has been installed or plugged in. A hardware keylogger can sit unnoticed at the back of the machine, and software ones survive between users. Anything you type there, including banking passwords, may be recorded. In my view, your own phone on mobile data is a much safer choice for anything sensitive, even if the screen is smaller.
At work
Monitoring software that employers install can function like a keylogger, so it falls under PIPEDA or provincial privacy laws, which require a reasonable purpose and proportionate collection. Ontario also requires employers with 25 or more staff to have a written electronic monitoring policy. For security, keyboard input on shared kiosks needs physical inspection, locked ports and tamper-evident seals. On managed endpoints, EDR rules for hook installation and unsigned input drivers catch software keyloggers that signature scanning misses.
Real-world examples
At home
Aisha logged into her email at a hotel business centre. Days later her account was hacked. The hotel later found a hardware keylogger attached to that computer's keyboard.
At work
Marcus manages IT at a Montreal accounting firm. EDR flagged keylogging behaviour from a fake PDF reader a staff member installed, and he removed it and reset the person's passwords.
How it compares
| feature | Software keylogger | Hardware keylogger |
|---|---|---|
| Form | Hidden program | Small physical device |
| How it gets there | Malware download | Someone plugs it in |
| Detection | Security software | Physical inspection |
| Remote access to logs | Usually | Sometimes, if wireless |
Software keyloggers sneak in online. Hardware ones need physical access.
For analysts
I'd make MFA mandatory for critical systems so a captured password isn't enough. And I'd remind staff never to log into work accounts on public computers.
History & origin
One of the earliest known keyloggers was a Soviet bug planted in IBM Selectric typewriters at the US embassy in Moscow, discovered in 1984 in an investigation known as Project Gunman; it had captured typed text for years. Software keyloggers spread with personal computers and became common in banking trojans in the 2000s. Some keyloggers were sold as parental or employee monitoring tools, blurring lines with stalkerware. Hardware keyloggers have been found in libraries and offices, sometimes used to steal logins from shared computers. Today, keylogging is one feature among many in infostealer and remote access malware. In my view, the Selectric bug is a great reminder that spying on keyboards is far older than the internet.