What is a keylogger — and how to protect your passwords from one
A keylogger records what you type — passwords included — and sends it to someone else. How keyloggers arrive, how to check for one, and the habits that make a stolen password far less useful.
Short answer
A keylogger is software that records the keys you press — and often the websites you visit — to steal passwords and other details. It usually arrives through phishing emails, Trojans or other malware. Run a full scan, including the offline scan on Windows, then change your passwords from a clean device and turn on two-factor authentication, ideally with an authenticator app or a security key.
Ad: buttons marked 'Ad' are affiliate links — we earn a commission if you buy through them, at no extra cost to you. It never changes our assessments. How this works.
A keylogger is a program that records which keys are pressed on a keyboard, usually to capture passwords, in NIST's definition. Some keep what they record on the computer for the attacker to collect later; others send it out automatically. Microsoft notes that keyloggers often work alongside password-stealing malware and record the websites you visit as well — so an attacker knows not just your password, but where to use it.
How keyloggers get onto a computer
- Phishing. Some phishing attacks install keystroke loggers along with other attacker tools, NIST notes.
- Trojans — programs that look useful but carry hidden malware.
- Rootkits. Microsoft describes rootkits as often part of a whole suite of malware that can record passwords and keystrokes.
- Bundled downloads and pirated software.
Signs you might have one
Keyloggers are built to stay out of sight, so there may be nothing to notice. General malware signs can still show up: a computer that slows down or crashes, tools like Task Manager or Activity Monitor that won't open, messages sent from your accounts that you didn't write — or sign-in alerts and two-factor codes for logins you didn't make.
How to check for and remove a keylogger
- Stop logging in to sensitive accounts on the computer you suspect.
- Update your security software and run a full scan.
- On Windows, run the offline scan too: Windows Security > Virus & threat protection > Scan options > Microsoft Defender Antivirus (offline scan). Microsoft says it works outside of Windows, so it can catch infections that hide themselves.
- Uninstall programs you don't recognise (on Windows 11: Settings > Apps > Installed apps).
- Change your passwords from a different, clean device, starting with email and banking, and turn on two-factor authentication.
- If the problem keeps coming back, reinstalling the operating system and restoring your files from a clean backup is the reliable fix.
Habits that make a keylogger far less useful
- Two-factor authentication. Even if a hacker knows your username and password, they can't log in without the second factor, the US FTC explains. Security keys are the strongest method because they don't use anything a hacker can steal; codes by text or email are the least secure kind.
- Passkeys, where a site offers them, replace the password altogether — there's nothing to type.
- A password manager or your browser can fill in saved passwords for you. That means less typing, but it's not a fix for a computer that's already infected.
- Don't count on the On-Screen Keyboard. Windows offers it as an accessibility tool, and Microsoft makes no security claim for it.
- Keep Windows or macOS and your security software updated, and download software only from official sources.
Can phones have keyloggers?
On phones the same idea usually shows up as spyware or stalkerware — apps that read your messages and record what you do. Our guide to spyware explains the signs and the safe way to remove it.
A keylogger steals what you type. Two-factor authentication makes what it steals far less useful.
Sources · checked 21 Oct 2026
- NIST CSRC Glossary — key logger
- NIST SP 800-83 Rev. 1 — Guide to Malware Incident Prevention and Handling (PDF)
- Microsoft Learn — How Microsoft identifies malware and potentially unwanted applications
- Microsoft Support — Device security in the Windows Security app
- Microsoft Support — Troubleshoot problems with detecting and removing malware
- Microsoft Support — Virus and threat protection in the Windows Security app
- Microsoft Support — Use the On-Screen Keyboard (OSK) to type
- FTC Consumer Advice — Malware: how to protect against, detect, and remove it
- FTC Consumer Advice — Use two-factor authentication to protect your accounts
- FTC Consumer Advice — Creating strong passwords and other ways to protect your accounts
Our pick for this situation
Our pick
Norton · Best all-in-one bundle
VPN and password manager in every Norton 360 plan. Covers Windows, Mac, Android and iOS.
- VPN and password manager in every Norton 360 plan
- Covers Windows, Mac, Android and iOS
Our pick
TotalAV · Best simple, all-in-one setup
One uncluttered app on every platform. Tune-up tools in every plan; VPN from Internet Security up.
- One uncluttered app on every platform
- Tune-up tools in every plan; VPN from Internet Security up
PrivacyTechReview Editorial Team
Editorial
Our editorial team researches consumer security products using public vendor documentation and independent laboratory reporting.
