What Is a Keylogger and How Does It Work?

A keylogger is software (or occasionally hardware) that records the keystrokes typed on a device. The term gets used in very different contexts — from a legitimate parental monitoring feature to a tool used in malicious hacking — so understanding both the mechanics and the range of use cases matters.

How Keyloggers Work

At a basic level, a keylogger runs in the background of a device and records what’s typed — messages, search queries, passwords, notes — often organized by which app or window was active at the time. In a legitimate parental or employer-monitoring context, this data typically syncs to a dashboard the parent or employer can review. In malicious contexts (like malware), the same basic function is used to secretly capture passwords or financial information and send it to an attacker without the device owner’s knowledge or consent.

Legitimate vs. Malicious Use

The technology itself is neutral — what determines whether keylogging is appropriate is consent and transparency:

Legitimate use: A parent monitoring a minor child’s device they own, or an employer monitoring a company-owned device with a documented policy and, where required, employee consent.

Malicious use: Software installed without the device owner’s knowledge to steal credentials, financial information, or private communications — this is illegal in virtually every jurisdiction and is a common component of malware and phishing attacks.

If you’re evaluating a parental control or employee monitoring product with keylogging as a feature, the same legal principles that apply to monitoring generally apply here too — device ownership, appropriate consent, and staying within your jurisdiction’s rules around recording someone’s activity.

What Keyloggers Can and Can’t Tell You

Keyloggers capture what’s typed, but they don’t necessarily capture context the way reading a full message thread might — for example, a search query typed and then deleted before sending might still be logged, which can occasionally surface information a person thought they’d reconsidered. This is worth being aware of if you’re weighing how much visibility a keylogging feature actually gives you versus how invasive it feels.

Signs a Device Might Have an Unwanted Keylogger

If you’re concerned about an *unauthorized* keylogger on your own device (rather than a monitoring tool you intentionally installed), watch for:

• Unexpected battery drain or device slowdown
• Unfamiliar apps or processes running in the background
• Unusual data usage
• Antivirus or security software flagging unknown processes

If you suspect an unauthorized keylogger, a factory reset combined with updating all passwords from a separate, trusted device is generally the safest response.

Frequently Asked Questions

Is using a keylogger on my child’s phone legal?

Generally yes if you own the device and your child is a minor, though the same general monitoring laws around age and jurisdiction apply — see our guide on whether phone monitoring is legal for parents for more detail.

Can keyloggers capture passwords?

Yes — this is exactly why unauthorized keyloggers are considered a serious security threat, and why legitimate monitoring products should be used only with proper consent and legal authority.

Do keyloggers work on both Android and iOS?

Capability varies by platform and by product — iOS’s more restricted app environment generally makes comprehensive keylogging harder to implement than on Android, which is one reason platform compatibility varies so much between monitoring apps.

Bottom Line

A keylogger is a tool, not inherently a threat — its legitimacy depends entirely on whether it’s used with proper ownership, consent, and legal standing. Whether you’re evaluating it as a monitoring feature or worried about one on your own device, the deciding factor is always the same: was this installed with legitimate authority, or without the device owner’s knowledge?