What Is Keylogger?

A keylogger records keystrokes. It is among the simplest ways to obtain credentials, because it captures them at the point of entry — before encryption, before hashing, before any protective control applies.

It captures everything typed, which includes passwords, messages, documents and search queries. That breadth makes it a serious privacy exposure as well as a credential one.

Software and hardware forms

Software keyloggers are a component of most credential-stealing malware and are detectable through behaviour: a process intercepting input system-wide has few legitimate reasons to do so.

Hardware keyloggers sit between keyboard and computer, or inside the keyboard, and are invisible to every software control — no process, no file, no network traffic until collected. They require brief physical access, which makes them a realistic threat in shared and public-facing workspaces.

What it does and does not defeat

It defeats passwords completely. It defeats one-time codes partially — the code is captured and is only useful within its validity window, which favours an attacker operating in real time.

It does not defeat hardware authentication keys or platform authenticators, because nothing secret is typed. That is the structural answer to this entire category.

Why it matters less than it once did

Attackers increasingly target session tokens rather than credentials, because a stolen session bypasses authentication regardless of how strong it is. Capturing a password is more work for a less durable result.

It remains relevant for high-value targets, for shared and public-facing workstations, and as one capability within broader spyware.

The hardware variant needs a physical control

No software will find one. The defences are physical: inspecting ports on shared and public-facing machines, tamper-evident seals, port blockers, and restricting physical access.

Shared clinical and retail workstations, reception desks, and conference room computers are where these are actually found, because they combine public access with credentialed use.

Detection and response

For the software form: processes registering system-wide input hooks, unexpected drivers, files accumulating captured text, and periodic outbound transfers of small volumes.

Response must assume every credential typed on that machine is compromised — which typically extends beyond corporate accounts to anything personal the user accessed, and is worth telling them explicitly.

Clipboard and screen capture travel with it

Input capture is rarely the only capability. The same tooling typically reads the clipboard, which defeats the common advice to paste passwords rather than type them, and captures screen contents at intervals.

That matters for the password manager recommendation: autofill directly into a field is safer than copy and paste, because the clipboard is as readable as the keyboard. It is a small detail that changes the guidance most people are given.

Shared and kiosk workstations deserve a specific policy, because they combine public physical access with credentialed use. Practical measures there: no saved credentials, sessions that end on user switch, physical port restriction, and a documented check of the hardware as part of routine maintenance rather than only after a suspicion.

Where to start

Physically inspect the ports on your public-facing and shared workstations. It takes minutes, it is the only way to find the hardware variant, and almost nobody does it.

See multi-factor authentication. GuardsArm runs penetration testing.