🔐 Keylogger Demo
A keylogger records every key a victim presses, often without them noticing, and sends that data to an attacker. Type in the form on the left like a normal user — the panel on the right shows what a keylogger running on that page would capture.
This only listens to the two fields below, on this page, in your browser. Nothing is
sent anywhere — the “exfiltration” log is simulated text so you can see how
attackers batch and send stolen data.
🧑 What the user sees
🕵 What the keylogger captures
Waiting for keystrokes…
Reconstructed username:
Reconstructed password:
📡 Simulated exfiltration
No data sent yet…
Real keyloggers don’t send one network request per keystroke — that would be too noisy and slow. Instead they buffer captured keys and periodically send a batch to an attacker-controlled server. This panel simulates that batching every few keystrokes; it never actually sends anything anywhere.
How this differs from a real keylogger
- Scope: this demo only sees the two fields on this page. A real keylogger typically hooks into the operating system, so it captures keystrokes in every application — browsers, chat apps, banking software, everything.
- Visibility: this demo shows its capture panel openly so you can learn from it. Real keyloggers hide — no window, no icon, sometimes disguised as a legitimate process or driver.
- Persistence: real keyloggers often install themselves to survive a reboot and keep running in the background indefinitely.
- Delivery: attackers get keyloggers onto a victim’s machine through phishing emails, malicious downloads, infected USB drives, or physical access to install hardware keyloggers between a keyboard and computer.
How to defend against keyloggers
- Keep your OS, browser, and antivirus/anti-malware software up to date.
- Don’t download software or open attachments from sources you don’t trust.
- Use a password manager with autofill — it types credentials without triggering normal key events the same way, and won’t autofill on a fake/lookalike site.
- Enable multi-factor authentication, so a stolen password alone isn’t enough to log in as you.
- On shared or public computers, be extra cautious — consider an on-screen keyboard or avoid logging into sensitive accounts entirely.