Can I protect against keylogging by using the mouse? For example, to enter the password hunter2, I might do the following:

  1. type ttter2
  2. select the first tt and press ← Backspace
  3. type hun

To a keylogger, it would like like I typed tt← Backspaceter2hun, or ttterhun. Would this provide adequate protection, or are keyloggers able to follow mouse gestures, clicking, selecting etc., so they would catch password still?

  • I would like to think this will be useful in some circumstances. However, it might depend on how much the intruder wants to get into the system. On an unrelated note, how much trust do you have that the machine does not have a keylogger?
    – kush
    Commented Dec 11, 2012 at 15:34
  • This "works" only against naive attackers. The keylogger will still pick up the maximum possible password length AND all characters contained in the password, even if it can't follow gestures. Commented Dec 11, 2012 at 17:16
  • I do this when typing in payment-card details. It might be fairly useless, but it can't hurt.
    – lynks
    Commented Dec 11, 2012 at 17:40
  • Not to mention, an attacker could record mouse movements as easily as key presses.
    – ewanm89
    Commented Dec 12, 2012 at 11:49

4 Answers 4


A lot of keyloggers are smart enough to catch this. Not only do they log the keys being physically pressed, but they also log the contents of password boxes whenever window messages are processed, or when browser forms are posted. They also often capture small blocks of the screen around the mouse cursor, to catch cases like this.

  • 2
    So they're not literally only keyloggers, then?
    – gerrit
    Commented Dec 11, 2012 at 15:36
  • 5
    90% of the time these days, no. They usually have various other features: remote access trojans, session / cookie stealers, file stealers, etc.
    – Polynomial
    Commented Dec 11, 2012 at 15:38
  • 4
    The one thing this might still fool is an inline hardware keylogger.
    – Iszi
    Commented Dec 11, 2012 at 16:22
  • Is there any alternative word for keylogger that is more descriptive of what it actually does? The word fooled me into expecting them to be less sophisticated than they really are.
    – gerrit
    Commented Dec 11, 2012 at 17:42
  • @gerrit: Screen-scrapers, I/O sniffers...
    – KeithS
    Commented Dec 11, 2012 at 19:24

It really just depends on how advanced the said keylogger is. Some keyloggers collect data from password boxes when the form is submitted, and some monitor when the keys are pressed. Some keyloggers can be really advanced and even record mouse movements, and your screen. If you do have an unwanted keylogger, I'd take time to try and eradicate it, instead of try to trick it. You don't want to take chances with malware.


Most are more complex than this, but even a limited key logger would still pick up enough information to be able to drastically reduce the entropy of guessing your password since it would be known what characters compose your password and would just be a matter of figuring out what to discard.

  • If I enter my password entirely by pasting in characters, a primitive keylogger would be lost, wouldn't it?
    – gerrit
    Commented Dec 11, 2012 at 16:24
  • If you pulled it entirely from pre-existing text, then yes, the very most basic would be lost, but that's probably less than 5% (WAG) of keyloggers. It's pretty easy to inspect windows elements and the clipboard. In short, it isn't really worth the effort it takes. Proactive prevention and two factor authentication (one time use keys) are a far better protection. Commented Dec 11, 2012 at 16:30

I perceive this as very cumbersome (moreso as I get older and mouse precision declines). I think that cost benefit analysis would suggest that reducing the probability of keyloggers would be a higher value strategy.

Not the answer you're looking for? Browse other questions tagged .