What Is a Keylogger? How Keystroke Theft Works and How to Detect It

The Free Game That Wasn't Free

Someone downloads a cracked copy of a paid game, or a "free" version of software that normally costs money. The installer runs, the program works exactly as expected, and nothing looks wrong. Weeks later, their email gets accessed from a country they have never visited, even after they changed the password twice. What they do not know yet is that a keylogger rode in with the installer on day one, and it has been recording every password they typed since, including both replacements.

A keylogger does one job: it records every keystroke made on the device, timestamps it, and sends the log to whoever planted it. Passwords, card numbers, private messages, search queries, all of it captured in order. Because the capture happens between your fingers and the application, a website's encryption never gets a chance to help: the keylogger reads what you typed before it is ever encrypted or transmitted.

Software Keyloggers vs Hardware Keyloggers

Keyloggers split into two categories, and the split matters for how you defend against each.

• Software keyloggers run as code on the device itself. They range from crude keystroke loggers to full kernel level rootkits that hide from the operating system, to browser based scripts that only capture what happens inside a web page. Software keyloggers dominate by a wide margin because they scale: one malicious installer can infect thousands of machines at once.
• Hardware keyloggers are physical devices, often the size of a USB adapter, plugged inline between a keyboard cable and the computer. They require someone to have physical access to the machine, which makes them rare against individuals but a real risk on shared office equipment, library computers, or any machine where a stranger could get thirty seconds alone with the cable.

How Software Keyloggers Actually Get In

1. Cracked and pirated software: The single largest vector by far. Game cheats, cracked productivity software, and "free" versions of paid tools are the classic delivery mechanism. The program does what it promised, and the keylogger rides quietly in the background.
2. Phishing attachments: Invoice PDFs, resume attachments, and document macros that install a stealer the moment they are opened. Our phishing guide covers spotting the bait before you click.
3. Malicious browser extensions: Extensions requesting broad page access permissions can capture form input across every site you visit, which functions as keylogging for anything typed in a browser.
4. Infostealer malware bundles: Modern malware families rarely just log keys anymore. They grab keystrokes, saved browser passwords, session cookies, and cryptocurrency wallet files in a single sweep, then package the whole bundle for sale on criminal marketplaces.
5. Physical access: A hardware keylogger clipped onto a keyboard cable, or a borrowed device that quietly gets new software installed on it during the loan.

Detecting an Infection

Modern malware is built to hide, so the absence of obvious symptoms proves nothing. These signs are still worth investigating when they appear together:

• A noticeable lag between pressing a key and the character appearing on screen, especially if it started recently.
• Unknown background processes consuming CPU, or antivirus and Windows Defender getting mysteriously disabled without you touching the setting.
• Accounts continuing to get accessed from unfamiliar locations even after a password change. This is the strongest tell: if a fresh password does not stop the unauthorized access, something on the device is capturing the new password the moment you type it.
• New browser extensions, startup programs, or scheduled tasks that you never installed.
• Contacts receiving messages or links from you that you never sent.

The brutal logic of an infected machine: every password typed on it is compromised the instant it is typed, not the instant it is used. Cleaning the infection has to come before changing passwords, or the attacker just collects the new ones as fast as you create them.

Why 2FA Blunts a Keylogger Without Fully Stopping It

This is the part that actually matters for your defenses. A keylogger captures both your password and the six digit TOTP code you type right alongside it. But that code expires within thirty seconds. By the time the log reaches the attacker, the password is only half the puzzle and the code is already dead. To get in, the attacker would need to use the captured code within that same thirty second window, which mass market keyloggers simply are not built to do in real time. That gap is exactly why enabling 2FA on top of a strong password meaningfully raises the cost of an attack, even on a compromised device, though it is not a total shield.

The stronger fix removes typed secrets from the equation entirely. Passkeys and hardware security keys involve no password and no code typed on the keyboard at all, so there is simply nothing for a keylogger to capture. See our passkey explainer and hardware key guide for how to move toward that model. Password managers help in a smaller way too: autofilled credentials are never typed, so pure keystroke capture misses them, although a full infostealer will often target the password manager's own database directly, which is why the manager's master password and its own 2FA still matter.

Cleaning Up an Infected Device

1. Stop logging into anything from the machine immediately. Assume every keystroke from this point is visible to someone else.
2. Run a full scan with Windows Defender or your antivirus, then a second opinion scanner such as Malwarebytes, since no single engine catches everything.
3. When in doubt, reinstall the operating system. For a deep or kernel level infection, a clean OS reinstall is the only outcome you can actually trust.
4. Only then change passwords, from a different, clean device, starting with email and banking. Our password generator makes strong replacements quickly.
5. Log out of all active sessions on important accounts, and review recovery email addresses and phone numbers for changes the attacker may have made while inside.
6. Enable 2FA everywhere it is still missing, which our beginner guide walks through step by step.

Frequently Asked Questions

Can a phone get infected with a keylogger, not just a computer?

Yes, though the mechanics differ by platform. On Android, malicious apps abusing accessibility permissions can capture input across other apps. On iOS it is rarer outside of targeted spyware aimed at specific individuals. Stick to official app stores, refuse accessibility permission requests from apps that have no reason to need them, and treat any app asking to display over other apps with suspicion.

Does browsing in incognito or private mode stop a keylogger?

No. Private browsing only changes what your browser itself remembers locally, not what malware sitting deeper in the operating system can observe. A software keylogger typically operates below the browser layer entirely, so private mode is irrelevant to it.

Will antivirus software reliably catch every keylogger?

No. Detection rates are strong against known, cataloged malware families and much weaker against brand new or custom built ones targeting a specific person. That gap is precisely why layered defense matters more than any single tool: safe download habits, 2FA to devalue whatever gets captured, and passkeys where they are available.

Do on screen or virtual keyboards actually help?

Somewhat, against pure keystroke logging specifically. But current generation stealer malware also takes periodic screenshots and reads clipboard contents, so a virtual keyboard is a speed bump rather than a real wall. Enabling 2FA and keeping the device clean protect you far more reliably.

How careful should I be using a hotel or library computer?

Assume you cannot trust it. If you must use one, glance at the keyboard cable for an inline device before typing anything sensitive, but treat everything typed there as potentially exposed. Avoid logging into important accounts on shared machines at all, and if it is unavoidable, change that password from your own device afterward and rely on 2FA having been active during the session.