Depending on the OS, it may be trivial for the keylogger to distinguish different input sources and filter out your random characters. And even if that's not the case, there are many places aside from the keyboard where a decent trojan will be looking for passwords, like RAM contents and screenshots.
Aside from that, your method will only work if you introduce lots of random characters. Let's assume the keylogger has captured a sequence of N
characters corresponding to M
characters of the password and N-M
random characters added by your method. Assuming M
is known, there are C(N,M)
possible passwords for the attacker to try. For example, if the keylogger has captured 16 characters and the password is known to be 8 character long, the attacker will discover the right password in
C(16,8) = 12870 attempts
If the password length is not known, the attacker could simply iterate through different possible values. For example if in the example above the password is known to be between 8 and 16 characters, the attacker will have to try out 39203 possible passwords.
Only when you add about 250 random characters to your 8 character password, the difficulty of cracking the keylogger data becomes equal to brute forcing an alphanumeric password. At this point, you should make sure you have a good random characters generator, because these 250 characters could be enough to crack the trivial ones.