A keylogger is software or hardware that records keystrokes. Malicious keyloggers can capture passwords and other sensitive information as a person types it.

Keystroke capture exposes information before many other controls can protect it. A password may travel over an encrypted connection and still be stolen on the device where it was entered. For customer accounts, captured credentials can become the starting point for an account-takeover attempt.

How a keylogger captures information

A software keylogger observes input through mechanisms available on the compromised system, such as input-handling functions. Its reach depends on its privileges and the protections of the operating system or application. Captured data may be stored locally or sent to an attacker.

Hardware keyloggers can sit between a keyboard and its connection to the computer, or be incorporated into modified equipment. Finding them requires attention to the physical device as well as software inspection.

Not every input-recording tool is malicious. Similar capabilities can appear in authorized testing or monitoring. The security concern is capture without appropriate authorization and the exposure of information the person expects to remain private.

What stolen keystrokes can reveal

Typed passwords are an obvious target, but a record may also include recovery answers or text entered into a customer-support conversation. A one-time code can be exposed while it is valid if an attacker can act quickly enough.

Imagine a customer signing in to a loyalty account from an infected shared computer. An attacker later uses the recorded credentials to redeem stored rewards. Password reuse can extend the exposure to other accounts, although the captured password still needs to be valid there.

Keylogging is distinct from reading saved browser passwords or stealing session cookies. An information-stealing program can combine those techniques, but a keylogger does not need to perform all of them. That distinction matters when investigating how an account was accessed.

Reducing the impact on authentication

Passkeys reduce reliance on typed, reusable passwords. They use a cryptographic exchange rather than sending a password the keylogger can collect. This addresses an important exposure without making an infected device trustworthy.

Malware with broader access may still interfere with a signed-in session or the actions performed through it. Device maintenance and appropriate endpoint protection therefore complement authentication changes. After suspected compromise, remediation should include the device and any credentials or sessions exposed through it.

For a service receiving the attacker’s sign-in, a correct password is only one piece of evidence. Changes in device context and suspicious account activity can justify additional verification before a sensitive action proceeds.

Frequently asked questions

Does HTTPS stop keylogging?

No. HTTPS protects data in transit. A keylogger captures input on the device, potentially before that data enters the encrypted connection.

Are keyloggers always software?

No. Hardware devices can record keyboard input too. Physical inspection can therefore matter alongside software-based detection.

Do passkeys make keyloggers harmless?

Passkeys remove the reusable password from that sign-in flow. They do not remove malware or prevent every form of abuse on a compromised device.

Related: Credential Management · Account Takeover (ATO) · Passwordless Authentication · Device Takeover · Passkeys · Session Hijacking