Definition
A keylogger is a surveillance program or physical device that secretly records every letter and number you type on a keyboard and sends it to someone else. Anything you type, like IDs, passwords, and chat messages, can leak out exactly as you entered it.
A spy behind the keyboard, watching you type
When you type on a keyboard, letters appear on the screen in the blink of an eye. The moment you press a key, an electrical signal travels into the computer, and the operating system reads it and shows the right character.
A keylogger sneaks into the middle of that signal path. Every time you type an online banking password or a message to a friend, it makes an exact copy of the signal on its way from the keyboard to the computer and quietly saves it to a file.
It doesn't help that the screen hides your password behind black dots (••••) or asterisks (**). A keylogger doesn't grab what appears on the screen. It intercepts the physical key signals from your fingers**, so it learns the real letters and numbers exactly as typed.
To be a bit more precise: it can be a device, not just a program
To be a bit more precise, keyloggers are not only malicious software secretly downloaded from the internet. They also come as a tiny hardware device, about the size of a fingertip joint, plugged in between the keyboard cable and the computer itself.
A software keylogger gets deep into the operating system through fake emails or sketchy download sites. A hardware keylogger works differently. Someone quietly plugs it into the back of a shared computer or an office PC and comes back later to collect it, along with the stolen information.
Hardware keyloggers almost never get caught by a computer's security software. They steal the signal at the level of electronic parts, not inside the computer's code. So no matter how carefully you run a security scan, the system sees just an ordinary keyboard.
How to keep your accounts safe from keyloggers
The scariest thing about a keylogger is that it can defeat the usual encryption on websites. Even if the connection is strongly encrypted, the information has already leaked at the moment you type it on your own computer, before the data is ever sent over the internet.
Luckily, there are ways to reduce the threat. A virtual keyboard, where you click the password with a mouse on a banking site, creates no physical key presses. So it can avoid a keylogger that only records keystrokes. But it doesn't help against methods that take a screenshot when you click or grab the typed value just before it is sent, so it is not a complete shield on an infected computer.
Turning on two-step verification also makes you much safer. Even if your ID and password leak, you still have to confirm a code on your own smartphone. Passkeys, which are now widely used and rely on fingerprint recognition or a hardware security key, are also a great shield against keyloggers.
Common misconceptions
If your password is hidden behind asterisks (****) on the screen while you type, a keylogger can't learn it.
What the screen shows is just a trick. A keylogger isn't looking at the monitor. It intercepts the signal for which key your finger pressed, so it learns your original password perfectly.
Where you meet it
A malicious keylogger is installed on a computer at an internet cafe or public library, and the game or web portal accounts you log in to get stolen.
You open a suspicious email attachment, and a keylogger program is secretly installed in the background.
In one sentence
A keylogger is an eavesdropping tool that intercepts the signal of every key you type. You can protect yourself by using uninfected devices and turning on two-step verification and passkeys.