What Is a Keylogger? How Keystroke Loggers Work, the Main Types, When They Are Legal, and How to Detect One

Keylogger Meaning

A keylogger is any tool that captures keystrokes as they are typed and stores or transmits them. The name is neutral about intent. The same capability sits inside banking trojans that steal credentials, inside parental control apps, inside some employee monitoring products and inside the debugging tools that software engineers use to reproduce input problems. What distinguishes a crime from a control is who owns the device, who consented and what is done with the data.

Keyloggers have existed for as long as electronic keyboards. The earliest documented example was a hardware implant fitted to IBM Selectric typewriters in the US embassy in Moscow in the 1970s, which transmitted the movement of the type ball by radio. Software keyloggers followed in the 1980s and 1990s and became a standard component of malware once online banking made typed credentials valuable. Today a keylogging module is included in most remote access trojans and information stealers, and standalone keyloggers are sold openly as “monitoring software” for parents and employers.

Because the term covers both malware and legitimate software, this guide treats the two separately: first how keyloggers work and the forms they take, then the legal rules for lawful use, then detection and defence, and finally why most business monitoring has moved away from capturing keystroke content altogether.

How Keyloggers Work

Every keystroke travels a path from the physical switch under the key to the application that finally displays the character. A keylogger intercepts that path at one of several points, and the point it chooses determines how hard it is to detect and what it can see.

1. Between the keyboard and the computer. A hardware device in the cable or inside the keyboard reads the electrical signals directly. Nothing on the computer can see it.
2. In the keyboard driver or kernel. A kernel-mode keylogger installs itself as a filter driver and reads every key event before the operating system passes it to applications. This is the hardest software form to detect and requires administrator rights to install.
3. At the operating system API. On Windows, a program can register a low-level keyboard hook or poll the keyboard state many times a second. This is how most commercial monitoring software and most commodity malware capture keystrokes; it runs in user mode and needs no driver.
4. Inside the browser or application. A form grabber hooks the browser's functions so it can read what was typed into a web form at the moment it is submitted, before the page encrypts it. It captures only what matters, usernames, passwords and card numbers, and ignores everything else.
5. On the web page itself. Malicious JavaScript injected into a compromised site records keystrokes inside that page and posts them to a remote server. The device is never infected; the website is.

Captured keystrokes are written to a hidden log file, often alongside the window title and timestamp so the attacker knows which application each sequence belongs to, and are then emailed, uploaded or fetched by a command-and-control server. Many keyloggers add screenshots on mouse click to defeat on-screen keyboards, clipboard capture to catch pasted passwords, and microphone or webcam capture.

Types of Keyloggers

For most organisations the realistic threats are the API-level and form-grabbing software types, delivered by phishing attachments, cracked software, malicious browser extensions or drive-by downloads. Hardware keyloggers matter where attackers have physical access: shared offices, retail counters, hot desks and public terminals.

Malicious vs Legitimate Keyloggers

Malicious keyloggers exist to steal. The targets are banking and payment credentials, corporate logins that lead to further access, email accounts used for password resets, cryptocurrency wallets and private messages used for extortion. Information-stealer malware families bundle keylogging with browser credential theft and clipboard hijacking, and sell the harvested logs in bulk. The victim rarely notices anything; the malware is designed to be quiet, and the damage appears weeks later as an account takeover or a fraudulent transfer.

Legitimate keyloggers exist to monitor or troubleshoot with the knowledge of the device owner. The accepted use cases are narrow:

• Employer monitoring of company devices, with notice to employees, for security, compliance and productivity purposes. Full keystroke content capture is the most intrusive form of employee monitoring and is increasingly replaced by activity-level measurement, discussed below.
• Parental control on a child's device.
• Incident investigation by an organisation's security team on a specific device for a defined period, usually under a documented authorisation.
• Software testing and usability research, where participants consent to input recording.
• Law enforcement, under a warrant.

The commercial products sold for the first two categories are technically similar to malware, and antivirus vendors often classify them as “potentially unwanted” or “riskware” for that reason. The distinction is purely one of ownership, notice and purpose, which is why the legal rules matter.

Is It Legal to Use a Keylogger?

The answer depends on three questions: whose device is it, did the person being monitored receive notice or give consent, and what is being captured.

Devices you own, used by employees. In the United States, federal wiretap law permits an employer to monitor communications on its own systems where there is a legitimate business purpose or consent, and consent is usually established through a written monitoring policy. Several states add explicit notice duties. New York has required private employers since May 7, 2022 to give written or electronic notice of electronic monitoring to every new hire, obtain an acknowledgment, and post the notice in a conspicuous place. Connecticut requires written notice to affected employees and a posted notice, with an exception for investigations where the employer reasonably believes the law or its rights are being violated. Delaware requires either a one-time written notice or a daily electronic notice, with a penalty of $100 per violation. Our state-by-state guide covers the rest.

What is captured matters even with notice. Logging the full content of keystrokes inevitably captures passwords, including personal ones, and the content of private messages typed during breaks. Capturing passwords creates a security liability for the employer, who is now holding every employee's credentials in a log file. Capturing private message content in states such as California, which require all-party consent to intercept confidential communications, or under the GDPR in Europe, where content-level keystroke logging is widely regarded as disproportionate, exposes the employer to claims no productivity benefit justifies. Our GDPR monitoring guide explains the proportionality test.

Devices you do not own. Installing a keylogger on a spouse's, partner's or other adult's device without their knowledge is a crime in every US state under computer-misuse and wiretap statutes, regardless of the relationship, and is prosecuted. The same applies to a personal device an employee brings to work unless they have agreed to monitoring of that device. For employees asking the mirror question, see can my employer monitor my home computer.

How to Detect a Keylogger

Most keyloggers can be found with a methodical check. Work through the following on any machine you suspect.

1. Inspect the hardware. Follow the keyboard cable to the port and look for any adapter or dongle between them. On a shared or public machine, check the back of the computer, not just the visible ports. Wireless keyboards older than about 2016 should be replaced if they lack AES encryption.
2. Run a full antivirus or EDR scan. Commodity keyloggers are detected by signature; newer ones by behaviour, such as a process registering a keyboard hook and writing to a file or network socket. Make sure the scan includes rootkit and driver checks for kernel-level variants.
3. Review running processes and startup entries. On Windows use Task Manager and Autoruns; on macOS use Activity Monitor and check Login Items and LaunchAgents. Look for unfamiliar names, processes with no publisher, and anything running from a temporary or user profile folder.
4. Check installed browser extensions. Remove any you do not recognise. Extensions are a common delivery route for form grabbers.
5. Watch outbound network traffic. A keylogger has to send its log somewhere. Unexpected periodic connections to unfamiliar hosts, especially at fixed intervals, are a strong indicator.
6. Check for a monitoring agent you were told about. On a company device, the most likely “keylogger” is legitimate monitoring software disclosed in your employment paperwork. Our guide to your monitoring dashboard explains what such tools typically collect.

Defences that make keyloggers less useful even when present: a password manager that autofills credentials so they are never typed, multi-factor authentication so a stolen password is not enough, keeping the operating system and browser patched, not installing cracked software, and least-privilege accounts so malware cannot install a driver. For organisations, endpoint detection and response (EDR), application allow-listing and USB device control close the main routes in. Our guide to blocking USB ports covers the hardware route.

Keystroke Intensity: The Business Alternative to Content Logging

Employers who once used full keyloggers for productivity measurement have largely moved to a different model: recording that keys were pressed, and how many, without recording which keys. Keystroke intensity, sometimes called input activity, counts keyboard and mouse events per minute and uses the count as one signal of whether a person is actively working. It cannot reconstruct a password, a message or a document.

The trade-off is deliberate. Content logging answers questions nobody should be asking of a general workforce, at the cost of holding every employee's secrets; intensity logging answers the question managers actually have, whether work is happening, without creating that liability. Combined with application and website categorisation, active and idle time and optional screenshots, it gives a fuller picture of productivity than a keystroke log ever did, because a keystroke log says nothing about what the typing was for.

E-Monitor's keystroke monitoring works this way: the agent records typing and mouse intensity and the application in focus, never the characters, and the data feeds the same productivity and attendance views as the rest of the platform. For a comparison of this approach with traditional content-capture tools, see our E-Monitor vs Spyrix comparison, and for the broader question of what monitoring is appropriate, is employee monitoring ethical.

Related reading: Does a VPN Hide Your Activity From Your Employer?, When Employees Disable Monitoring Software, Can Employers Detect Mouse Jigglers?.

Frequently Asked Questions