What a keylogger is

A keylogger is a type of malicious software (or, less commonly, a legitimate monitoring tool) designed to record what a user types on a keyboard. The captured data can include plain text (what keys were pressed), sometimes metadata (such as timestamps or window titles), and in some cases the contents of form fields.

Because keyloggers can be installed by malware bundles, malicious downloads, phishing, or compromised systems, they are best understood as a threat to both privacy and account security. If attackers can reliably capture credentials, they may use them for unauthorized logins.

How a keylogger works

Most keyloggers rely on hooking into the way the operating system processes keyboard events, allowing the program to observe keystrokes as they occur. Common technical approaches include:

  • User-mode keyboard interception: the program listens for keyboard events within the currently running user session.
  • Window or focus awareness: it may record which application window is active so keystrokes are easier to interpret.
  • Form-field capture: some keyloggers go beyond raw key events and attempt to read what’s entered into specific input elements.

After collection, a keylogger typically stores data locally and may later transmit it to a remote server, or it may overwrite logs and exfiltrate in the background. Even when exfiltration is not observed, the risk comes from what is captured and how easily it can be used.

Common limitations and what keyloggers may not capture

Keyloggers are not all-powerful. Practical limits include:

  • Context limitations: if the keylogger only sees raw key events, it may miss text rendered by secure input components.
  • Secure entry fields: some password entry methods use protections that can reduce what an in-process logger can observe; results vary by system and implementation.
  • Timing and permissions: if the malware is blocked, sandboxed, or runs without sufficient access, it may not record reliably.
  • Partial coverage: some keyloggers capture only certain applications, windows, languages, or user sessions.

A key takeaway: even if you don’t see a password immediately, the keylogger could still capture other inputs (usernames, answers to security questions, or any typed data). Conversely, “captured keystrokes” does not guarantee every sensitive field is fully readable.

A keylogger is closely related to other credential-stealing and surveillance techniques, but the method differs:

  • Credential phishing: tricks users into typing credentials into a fraudulent page; it’s about deception rather than low-level keyboard interception.
  • Screen capture or clipboard theft: focuses on what’s displayed or what’s copied, not necessarily raw keystrokes.
  • Stealers beyond input: some malware targets stored passwords or browser data, which bypasses keyboard logging entirely.

Thinking in “what it observes” helps: keyloggers focus on keyboard input; other malware may focus on network traffic, files, screenshots, or browser storage.

Practical checks you can do

Use a layered approach. The goal is not to prove a negative, but to find signs of suspicious software and unsafe behavior.

  • Check for unknown or recently installed software Review your installed apps and browser extensions for anything you don’t recognize, especially if it appeared around the time you first noticed suspicious activity.

  • Inspect startup and persistence mechanisms Look for unexpected items in system startup lists and user login helpers. Keyloggers often try to start automatically after reboot.

  • Review permissions and input-related access On some systems, apps can request permissions that let them observe activity or capture input. If an app has unusually broad permissions compared to its purpose, treat it as suspicious.

  • Run reputable malware scans Use trusted security tools to scan the system and also perform an offline or “deep” scan when available. If you do find a detection, follow the tool’s remediation steps.

  • Validate account security If you suspect credential compromise, change passwords from a trusted device, and consider enabling multi-factor authentication. Also check login sessions and revoke unknown sessions.

  • Look for behavioral anomalies Unexpected outbound network connections, high CPU usage, or repeated prompts can be indicators. Still, benign software can also cause unusual behavior—so verify with multiple signals.

When to treat it as urgent

Act urgently if you have reason to believe credentials were entered during suspicious activity, such as:

  • A recent compromise of email, password manager, or browser accounts
  • Alerts from security software
  • Unrecognized logins or password resets

In those cases, prioritize account recovery and incident containment. For higher-risk environments, consider involving qualified security support.

Remaining uncertainty

There is no universal “single test” that definitively confirms the absence of keylogging. Many defenses reduce likelihood, but keyloggers can be designed to avoid detection, and their capabilities differ by implementation. Treat checks as risk reduction and verification, not absolute proof.