An answer many don’t want to hear.
No.
If there’s a keylogger on your device, there is no way to know for sure how to prevent it from capturing your keystrokes.
Let’s review keylogging and explain why (for the most part) your suggestions don’t work.
There's no magic keylogger bypass
A keylogger is malware that records your keystrokes. It can also record much more. While some are simple to sidestep, sophisticated keyloggers are nearly impossible to outsmart. Each bypass technique suffers from weaknesses that advanced keyloggers easily avoid. The only true solution is to prevent malware on your computer in the first place.
Keyloggers
A keylogger (short for keystroke logger) is a form of malware, plain and simple.
As its name implies, its primary job is to capture your keystrokes and share the collected data with someone else. The most obvious example is capturing your login credentials and sending them off to some hacker who uses them to sign in to your account.
The name is misleading. Keyloggers can log much more than keystrokes, and it’s that aspect that prevents most bypass techniques from working.
Help keep it going by becoming a Patron.
Keylogger basics
Keyloggers use several methods to gather and share the information they collect.
- They may send each keystroke immediately to a remote server via the internet.
- They may collect keystrokes into a file and periodically upload it.
- They may collect keystrokes into a file and periodically receive instructions to upload it.
- They may collect keystrokes into a file that someone with access to the device could copy.
- They may be hardware devices inserted between the keyboard and the computer.
While almost all of those can be defeated, there’s more to the game than keystrokes.
Related
Sometimes, the Threat Is in the Hardware
When it comes to security, you probably think about viruses and scams, but what about the hardware you touch every day? I'll cover four hardware threats and the habits that can keep you safe from all of them.#27772
Keylogger advanced techniques
Yes, keyloggers collect keystrokes. But they’re not limited to recording only keystrokes.
So let’s stop calling them keyloggers and call them what they really are: malware.
- Malware can insert itself into the software that’s receiving the keystrokes — the username and password fields of a login form, for example — and collect the entries when you press Enter.
- Malware can insert itself into the clipboard chain and capture anything copied to the clipboard.
- Malware can watch the data you send over the internet — even before it’s encrypted on your device — and capture it.
That’s all focused on text and keystrokes. It gets worse.
- Malware can take a screenshot every time you click your mouse.
- Malware can record your mouse movement and the positions of clicks.
It’s these last two techniques that beat many of the so-called keylogger bypass tools and techniques.
Why so-called solutions don’t work
“File/Work Offline” — instructing your browser to act as if there were no internet connection — does nothing. The keystroke logger either doesn’t pay attention to it and goes online anyway, or it records to a file to be sent and picked up later, when you are online.
Using the on-screen keyboard can be recorded as easily as any keyboard (it truly does mimic a keyboard, after all), or your interactions with it can be captured using screenshots and mouse tracking.
The clipboard, as we’ve seen, can easily be monitored and its contents captured.1
Password managers either mimic keyboards (and hence can be captured) or fill in fields directly (which can also be captured).
Even so-called “key scramblers” are ineffective, since at some point, the application you’re typing into must be able to see the actual keystrokes you’ve typed. At that point, malware can insert itself and capture whatever has been entered.
And, of course, hardware keyloggers can only be bypassed by removing the malicious hardware.
Sometimes isn’t good enough
One of the more frustrating parts of this discussion is that almost all bypass techniques are effective sometimes. A keylogger that only logs keys as they are entered from a keyboard can be bypassed using a password vault or an on-screen keyboard, for example.
Whenever I post an article or video on the topic, I get all sorts of pushback. “What about this technique? What about that technique?”
Sure. They’ll bypass some keyloggers, just not all.
How do you know you don’t have a sophisticated piece of malware that logs keystrokes, screenshots, mouse movements, and more? It could be recording all of the actual unscrambled data your applications need to see.
How do you know your approach to bypassing keyloggers will work against the actual keylogger malware on your device?
You don’t.
There is no bypass for all possible keyloggers.
There is no bypass for all possible malware. And keyloggers are just malware, with all the capabilities of malicious software that makes it onto your device.
Do this
There is only one effective bypass: prevention.
Prevention means not allowing keyloggers or any form of malware onto your device in the first place. If they’re not present, they can’t capture anything. That’s the only 100% reliable solution.
Start here: Internet Safety: 7 Steps to Keeping Your Computer Safe on the Internet.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Podcast audio
Footnotes & References
1: We saw this some time ago when an update to Apple’s iOS exposed just how many applications were peeking at the clipboard on the iPhone.
Hi Leo,
Which programs do you recommend to scan my PC to check if keylogging malware are installed?
Thank you.
This article has recommendations for anti-malware tools, including free anti-virus, anti-spyware and more:
http://ask-leo.com/what_security_software_do_you_recommend.html
Unfortunately, no antimalware program gets everything and some keyloggers fly below the radar especially hardware loggers which can’t be detected via software.
I have thought that entering keystrokes into a number of documents (ie, 2 notepad sessions and the secure session) would go a long way to secure your PW to the secure session. Use the mouse cursor to select the session and the location for text insertion within the session.
And, again, malware could easily be recording everything you’re doing, all the steps you’re taking, and reconstructing it all. It’s no guarantee that you’ve secured anything.
What if you start Windows 10 in “safe mode without networking” (“F8” – “5”)? That mode prevents any non- WIN10 software from loading, but you can still access the web. So that method should allow you to safely log into your bank account (as an example) without a key logger being active.
Another one: If you start Microsoft’s “program explorer” (with admin privileges), you can see any app that has loaded on your PC, and especially the ones that do not show anything at the “description” and/or “company name” box are of interest. Then, “program explorer” allows you to kill those apps. Would that be a solution?
Two things: “without networking” explicitly prevents web access — you would not be able to access your bank, and two I believe it’s a serious mistake to assume safemode would not run malware. Malware can insert itself in many ways. Thus I would NOT count on this to bypass keyloggers.
Yes, many applications — both legitimate and malicious — both do and don’t include information in description and company name. That’s not a good indicator of whether a program is legit.
Not sure what you’re asking for a solution for.
One (almost) sure-fire method to bypass a keylogger is to boot from a Linux live distribution to do your banking. I don’t do this but I know someone who does. I say almost because it won’t bypass a hardware keylogger but someone would have to get their physical hands on your computer for that.
My employer uses keyloggers to compare fellow employee activities. Is there anyway to circumvent this practice while not getting fired?
Aside from getting a different job, probably not. Though I suppose you can check the privacy laws wherever you happen to be, but that too would just let your employer know you’re trying to avoid their surveillance. It’s very likely that what they’re doing is completely legal.
It’s easy too circumvent your boss spying on you. Don’t do anything non-work related on that computer and don’t take more breaks from you work than allowed.
Are keyloggers a threat to Chromebooks?
Keyloggers are a threat on any device that is at risk of malware.
So yes.
Though Chromebooks don’t seem to be as popular a target for hackers.
“Chromebooks don’t seem to be as popular a target for hackers.”
YET!
Beyond the usual practices for safe Internet access. I use Windows Defender, the anti-malware suit that comes with Windows, and I’ve taken the time to find the security features that are not enabled by default, and I’ve enabled everything that’s accessible in the Security Dashboard because nothing in there will negatively impact my use of Windows 11 Pro 26H2. With that said, you must do your own research because what works for me may be too much for you.
Further, I’ve secured my home Network as best I can by ensuring that my router is configured to ignore (not just block) incoming connection requests and pings on all ports, because if my IP address gets scanned, the scanner receives nothing in response, making it appear that there is nothing present, effectively making my home LAN invisible to the Internet.
While I know that there is no such thing as perfect security, I believe that I’ve made my LAN and devices as secure as possible, making them a difficult enough target that most attackers will seek lower-hanging fruit. Please don’t be a member of that low-hanging population.