How to Detect and Remove Keyloggers (and Keep Them Off Your Devices)

A keylogger records what you type. Some also grab screenshots, clipboard contents or the names of the windows you have open. The point is almost always the same: collect passwords, card numbers and private messages without the person at the keyboard noticing. This guide explains the two main kinds, how they end up on a computer, the signs worth checking, and what to do if you find one.

We used to run a list of keylogger products on this page. We removed it. Naming the best tools for spying on someone is not useful to anyone trying to protect their accounts, and secretly installing a keylogger on a device you don’t own is illegal in many countries.

Hardware and software keyloggers

Hardware keyloggers are small physical devices. The common type looks like a USB adapter and sits between the keyboard cable and the computer. Others are built into a keyboard or hidden inside it. They need someone to get physical access to the machine, but they don’t depend on the operating system, so antivirus software usually can’t see them. Some models store keystrokes on internal memory; others send them out over Wi-Fi.

Software keyloggers are programs. On Windows they often hook into the way the system passes keyboard input to applications. Many arrive bundled inside other malware: banking trojans and information stealers frequently include keylogging along with password and cookie theft. There are also browser-based versions, such as malicious extensions or scripts injected into a checkout page that capture what you type into a form.

Keyloggers are old technology. Soviet agents planted devices in IBM Selectric typewriters at the US Embassy in Moscow in the 1970s and early 1980s, and software keyloggers were circulating on Usenet by the early 1980s. What changed is how easy they became to get and deploy.

How keyloggers get onto a device

• Phishing attachments and links. A document, archive or fake invoice installs malware that includes a keylogger.
• Fake or cracked software. Pirated games, “free” versions of paid apps and fake updates are a common delivery route for information stealers.
• Malicious browser extensions. An extension that can read every page you visit can also read what you type into it.
• Unpatched software. Old browsers, plugins and operating systems give malware a way in without you clicking anything obvious.
• Physical access. A shared office PC, a hotel business center computer or a library terminal can have a hardware logger plugged into the back.
• Stalkerware. Someone with access to your phone or laptop installs monitoring software to watch you. This is often a partner or ex-partner, and it is a safety issue as much as a technical one.

Signs a keylogger may be present

Good keyloggers are designed to stay quiet, so there may be no symptoms at all. These are the things worth checking:

• An unfamiliar adapter or dongle between your keyboard and the computer, or a keyboard you don’t recognize.
• Programs you didn’t install in your app list or startup items, or a browser extension you don’t remember adding.
• Security alerts from your email, bank or social accounts about sign-ins you didn’t make, especially soon after you changed a password.
• Your security software has been switched off and won’t stay on.
• On a phone: apps with accessibility or device administrator permissions you didn’t grant, unexplained battery drain or data use.

None of these prove a keylogger is there. Together, or combined with accounts that keep getting taken over, they are a strong reason to investigate.

How to check and remove one

1. Look at the hardware. Follow the keyboard cable to the port. Anything in between that you didn’t put there should come out. On a work machine, report it to IT before unplugging it, since it may be evidence.
2. Run a full scan with your installed security software, then a second opinion scanner from a different vendor. Microsoft Defender’s offline scan is useful on Windows because it runs before the normal system starts.
3. Review installed programs, startup items and browser extensions. Remove anything you don’t recognize, then check again after a restart.
4. If you suspect stalkerware, think about safety before removing it, because the person who installed it may notice. Organizations such as the Coalition Against Stalkerware publish guidance for this situation.
5. When in doubt, reinstall. Backing up your files and reinstalling the operating system is the most reliable fix for a badly infected computer.

After cleaning, change your passwords from a different device you trust, starting with email, because email resets everything else. Sign out of all sessions where the service offers that option.

How to protect yourself

• Turn on multi-factor authentication. A stolen password is far less useful when a login also needs a code or a security key. Passkeys and hardware keys are better still, because there’s no password to type.
• Use a password manager. Autofill means you type fewer passwords, and a unique password per site limits the damage when one leaks.
• Keep everything updated: operating system, browser and extensions.
• Install software only from official sources and skip cracked apps entirely.
• Be wary of shared computers. Avoid signing in to banking or email on public terminals.
• Lock your devices with a PIN or password so someone with a few minutes alone with them can’t install anything.

Keyloggers at work

Some employers use keystroke monitoring on company devices, and parents sometimes use monitoring software on a child’s device. The rules vary a lot by country and state, and usually depend on ownership of the device and whether people were told. If you run IT for an organization, get legal advice and put any monitoring in a written policy. Security teams also run keylogger detection as part of endpoint protection, since information stealers are a common first step in ransomware and account takeover attacks.

For more on stopping account theft, see our guide to how email accounts get compromised and our list of cybersecurity tools.

George Mutune

I am a cyber security professional with a passion for delivering proactive strategies for day to day operational challenges. I am excited to be working with leading cyber security teams and professionals on projects that involve machine learning & AI solutions to solve the cyberspace menace and cut through inefficiency that plague today's business environments.