This question also applies to clipboard monitoring.
Imagine you are planning to deploy 100,000 copies of a Windows trojan with keylogger functionality. (For the record, I'm not talking about myself here.) Your trojan is going to send you megabytes of user input every day, 99.999% of it irrelevant. How do you find passwords in this flood of text and what can your victims do to mitigate the threat?
I see but one possibility: You have to intercept only the text entered after a known bank/email/etc page became active in a browser. But to tell it did?
1a) Monitor the titles of browser windows for known pages.
Mitigation: Use a browser with bank mode that does not reveal page name in its window title.
1b) Break into the address space of a browser to see what it is actually working with.
Mitigation: Impossible apart from relying on your antivirus. However, this approach is highly sophisticated and used mostly in government-made malware in targeted attacks on political opponents. A simple guy like me is not likely to run into this.
2a) Monitor DNS requests for known domains with WinPcap and such.
Mitigation: Don't have WinPcap installed.
2b) Monitor DNS requests with a custom firewall-type driver.
Mitigation: Same as 1b.
Overall, from the common user's perspective a browser with bank mode plus the absence of WinPcap plus an antivirus for general safety seems to be a sufficient protection against keyloggers. Did I miss anything?