How it works
A keylogger sits between the keyboard and the operating system or application. It records each key event before the text reaches its destination, so the log holds whatever a person types: credentials, messages, drafts, search queries.
- 1
Key press
The user presses a key, and the keyboard sends the signal to the computer.
- 2
Interception
Software hooks keyboard events in the operating system or in an application. A hardware device sits between keyboard and computer, or inside the keyboard itself.
- 3
Recording
Each key event is written to a log before the text reaches the application.
- 4
Use of the log
A criminal tool stores the stream or sends it to an attacker. A corporate monitor saves each record with the application, user account, and timestamp.
Types of keyloggers
Keyloggers differ by where they intercept input and how they are built.
| Type | How it works |
|---|---|
| Software | A program that registers keyboard events. The umbrella term for most tools, from crude scripts to commercial products. |
| Kernel-level | A driver deep in the system, close to the keyboard hardware. Hard to detect and typical of sophisticated attacks. |
| API-based | Uses the keyboard interfaces the system offers to applications. Common in both commodity malware and monitoring agents. |
| Form-grabbing | Captures web form text in the browser as it is submitted, before the site encrypts it. Common in banking fraud. |
| Hardware | A device between keyboard and computer, or a modified keyboard. Needs physical access, and security software cannot see it. |
Keyloggers as malware
In criminal hands a keylogger is spyware. Its main target is credentials: passwords for corporate mail, banking sites, VPNs, and admin consoles. A stolen password opens everything the real user can access, without a single alarm. That makes the keylogger a classic initial-access tool, from banking trojans to espionage campaigns. The log also holds message drafts and document text.
Channel-level controls rarely catch it. The text is captured before anything is sent: no file moves and no unusual traffic appears. Defense relies on several layers:
- Multi-factor authentication, which makes stolen passwords far less useful
- Endpoint protection and timely patching
- Control over installed software
- Physical inspection of workstations for hardware keyloggers
Corporate keystroke monitoring
Organizations use the same capability on their own workstations as part of user activity monitoring. The goal is evidence at the source: what was typed in a document before it left the machine, what was entered in a chat, which database queries were run. Channel interception shows that a file moved. Typed text often shows how the incident was prepared.
The mechanism is similar to malware. The purpose, transparency, and safeguards are not:
| Aspect | Criminal keylogger | Corporate monitoring |
|---|---|---|
| Purpose | Stealing passwords and data | Security evidence and investigations |
| Devices | Any device the attacker reaches | Company-owned devices |
| Transparency | Hidden from the user | Employees informed in advance |
| Log access | The attacker | Authorized staff only |
| Retention | No limits | A period set in advance |
| Passwords | The main target | A separate, controlled category |
In the agent profile
In Anexet the keylogger is one switch in an agent profile, next to PC activity monitoring and clipboard control.
Legality at work
Whether workplace keystroke monitoring is lawful depends on the country and the method. Most regimes ask three questions: is the purpose legitimate, such as security rather than general surveillance? Is the measure proportionate? Were employees informed? Covert, continuous monitoring of typing is treated as a serious intrusion almost everywhere.
In practice, defensible use rests on a written policy, a defined security purpose, restricted log access, and fixed retention periods.
Further reading: Malware: Top 7 dangerous programmes in 2025.
| Jurisdiction | Key rule |
|---|---|
| European Union | Under the GDPR, keystroke logs are personal data. Processing needs a lawful basis, purpose limitation, minimization, and transparency. Covert monitoring is generally disproportionate. |
| Germany | Technical devices suitable for monitoring employees require works council (Betriebsrat) co-determination. Courts accept open keystroke logging only in narrow cases. |
| Italy | Article 4 of the Statuto dei Lavoratori allows remote monitoring only for organizational, production, security, or asset-protection needs, usually with a union agreement or labor-authority approval. |
| United States | Monitoring employer-owned devices is broadly permitted. Notice is expected, and state consent laws on recorded communications can limit collection. |
How Anexet handles this
Anexet records keystrokes in its Activity module. The endpoint agent logs typed text with the application, user account, and timestamp, so the log becomes searchable text in the console rather than an opaque stream.
Anexet is deployed on-premise, so keystroke logs stay inside the organization's own infrastructure. That matters: typed text is sensitive personal data, and where it is stored matters as much as what is collected.
What is captured
keystrokes in any application in focus, from email clients and browsers to messengers. Text typed into password fields is flagged as a separate, searchable attribute.
Search and correlation
records can be searched by text, application, and time range, and reviewed alongside intercepted communications and file transfers in an investigation.
Audit trail
each record carries the user, application, and timestamp: who typed what, and where.
Keystroke capture in Anexet
Learn more