Skip to main content
Identity Authority
Category: Privileged Access

Keystroke Logging

Also known as: Keylogging, Keyboard Capturing, Keystroke Logger, Keylogger
Simply put

Keystroke logging is the recording of the keys a person presses on a keyboard as they type. Attackers often use it maliciously by installing software or hardware on a victim's device to secretly capture and store what is typed, which can include passwords and other sensitive information.

Formal definition

Keystroke logging (keylogging) is the action of recording the keys pressed on a keyboard, typically implemented through software (a form of malware) or dedicated hardware that intercepts and stores keyboard input. In an attack context, adversaries compromise a target device and install a keylogger to capture typed data such as credentials, potentially exposing knowledge-factor secrets used in authentication. Note that the evidence provided describes keystroke logging at a general level and does not detail specific interception techniques, mitigations, or its interaction with particular authentication mechanisms; those are out of scope for this definition.

Why it matters

Keystroke logging directly threatens knowledge-factor secrets, passwords, PINs, and answers to security questions, because it captures exactly what a user types before that input is protected by hashing, transport encryption, or other downstream controls. When an attacker compromises a device and installs a keylogger, the credentials a user enters can be recorded at the moment of typing, undermining authentication regardless of how strong the underlying password may be. This makes keylogging a persistent concern for anyone whose security model still depends on typed secrets.

For identity and access teams, the significance is that keylogging attacks target the point of credential entry rather than the identity provider or directory itself. A stolen password harvested from an endpoint can enable an attacker to authenticate as a legitimate principal, so the compromise of a single device can translate into unauthorized access across systems that trust that credential. The evidence provided describes keylogging at a general level and does not detail specific mitigations or how keylogging interacts with particular authentication mechanisms, so any defensive measures should be evaluated against your own deployment context.

Who it's relevant to

IAM engineers and security architects
Because keylogging targets the entry of knowledge-factor secrets on endpoints, teams responsible for authentication design should account for the risk that typed credentials can be captured on a compromised device. The evidence here does not prescribe specific countermeasures, so mitigation choices should be assessed within your own environment.
System administrators
Administrators who manage endpoints face the risk that keyloggers, whether software-based malware or physical hardware, can be installed on devices under their care and silently record keyboard input, including administrative credentials.
Compliance officers and identity governance leads
Keylogging represents a threat to credential confidentiality, which is relevant when assessing how sensitive typed information such as passwords could be exposed if endpoints are compromised. The evidence provided covers the threat at a general level rather than detailing regulatory or control-framework specifics.

Inside Keystroke Logging

Software-based keyloggers
Malicious or monitoring software running on an endpoint that intercepts keystrokes at the operating system, API, or kernel level, capturing knowledge-factor credentials such as passwords and PINs as they are typed.
Hardware-based keyloggers
Physical devices inserted inline between a keyboard and a system, or embedded within hardware, that record keystrokes independently of the operating system and are typically not detectable by host-based software scanning.
Credential capture surface
The knowledge factors most exposed to keystroke logging, including static passwords, PINs, and typed one-time codes; possession- and inherence-based factors are generally not directly captured by keystroke interception.
Exfiltration channel
The mechanism by which captured keystrokes are stored locally or transmitted to an attacker, which turns keystroke logging from local recording into a credential-theft pathway.
Authentication impact
Keystroke logging is an attack against the authentication step by compromising typed credentials; it does not by itself grant authorization, though stolen credentials may subsequently be used to obtain authorized access.

Common questions

Answers to the questions practitioners most commonly ask about Keystroke Logging.

Is keystroke logging the same as a phishing attack?
No. Keystroke logging is a technique for capturing keystrokes as they are typed, typically to harvest credentials, session data, or other sensitive input at the endpoint. Phishing is a separate technique that tricks a user into voluntarily disclosing credentials, often through a fraudulent site or message. Keystroke logging captures input passively at the device level, whereas phishing solicits it. The two are sometimes combined in an attack chain, but they are distinct methods and should not be conflated.
Does using multi-factor authentication make keystroke logging irrelevant?
Not entirely. MFA reduces the value of a captured knowledge factor such as a password, because an attacker still needs an additional possession or inherence factor. However, keystroke logging can still capture a typed one-time passcode, and in some deployments that code may be replayed within its validity window, or the attacker may pair the logger with session hijacking. Phishing-resistant methods based on possession factors that are never typed, such as FIDO2 authenticators, are generally more resilient to keystroke logging than typed codes, depending on configuration. MFA raises the bar but does not by itself neutralize the technique.
How does keystroke logging affect the security of typed passwords and OTPs in an authentication flow?
Any credential entered via keyboard is exposed to a keystroke logger operating on that endpoint, including static passwords, PINs, and typed one-time passcodes. Because keystroke logging targets the input step of authentication rather than the verification step, it undermines knowledge factors and any factor that requires manual entry. In most deployments, mitigations focus on removing typed secrets from the flow where possible and on protecting endpoint integrity rather than on changing the authentication protocol itself.
What authentication methods reduce exposure to keystroke logging?
Authentication methods that avoid typed secrets are generally less exposed. FIDO2 and WebAuthn-based authenticators and passkeys typically rely on possession of a device and a cryptographic operation that is never entered via keyboard, which removes the keystroke as an attack surface for the primary factor. Note that these approaches are not interchangeable synonyms and their exact behavior depends on the authenticator and relying party configuration. Where typed factors remain in use, the residual exposure remains and should be addressed through endpoint controls.
Where does mitigation of keystroke logging fit relative to identity governance and runtime enforcement?
Keystroke logging is primarily an endpoint and credential-protection concern rather than an identity governance or policy enforcement concern. It is generally out of scope for IGA functions such as provisioning, access reviews, and certification, and it is not addressed by runtime components such as a PDP or PEP. Mitigation typically belongs to endpoint security, credential design, and monitoring, though the credentials a logger might capture are the same ones those governance and enforcement systems ultimately rely on.
What monitoring or detection signals are relevant to keystroke logging in an identity context?
Because keystroke logging occurs at the endpoint, detection typically relies on endpoint security tooling rather than on identity infrastructure directly. From an identity perspective, indirect signals may include anomalous authentication patterns such as logins from unexpected contexts or credential use inconsistent with normal behavior, which could suggest captured credentials are being replayed. These signals are suggestive rather than conclusive, and their availability and reliability depend on the logging, session management, and anomaly-detection capabilities of the specific deployment.

Common misconceptions

Multi-factor authentication makes keystroke logging irrelevant.
MFA raises the bar but does not fully neutralize keystroke logging in all cases. Typed one-time codes and knowledge factors can still be captured, and depending on configuration an attacker may combine logged credentials with real-time relay or session compromise. Phishing-resistant possession factors such as FIDO2/WebAuthn authenticators are generally more resilient because the secret is not typed.
Keylogging is purely a malware problem solved by antivirus software.
Hardware keyloggers operate independently of the operating system and are typically undetectable by host-based software scanning, so anti-malware controls address only part of the risk. Physical and endpoint controls are also relevant.
Keystroke logging lets an attacker directly bypass authorization controls.
Keystroke logging targets the authentication step by stealing typed credentials. Authorization decisions are separate; captured credentials may later be used to authenticate and thereby obtain whatever access the account is authorized for, but the logging itself does not alter access control policy.

Best practices

Prioritize phishing-resistant, non-typed authentication such as FIDO2/WebAuthn passkeys so that authentication secrets are never entered via keystrokes that could be intercepted.
Deploy endpoint detection and hardening to reduce software keylogger exposure, while recognizing that host-based scanning typically cannot detect inline hardware keyloggers.
Enforce physical security controls on endpoints and keyboards, including inspection of USB and inline connections, to address hardware-based keystroke logging.
Treat any credential entered on a potentially compromised device as exposed, and support rapid credential rotation and session revocation as part of incident response.
Combine authentication factors so that a captured knowledge factor alone is insufficient, favoring possession and inherence factors that are not exposed through typing.
Monitor for anomalous authentication behavior, such as credential reuse from unexpected locations, to detect downstream use of credentials that may have been captured.
Promotional banner highlighting failures found in PCI audits and how to spot the gaps