This project demonstrates how keyboard input events can be captured in Python using the pynput library. It is intended for educational and cybersecurity awareness purposes, particularly to illustrate how software behavior may appear similar even when presented under different filenames.
The repository includes two identical scripts:
keylogger.pyservices32.py
Both files contain the same logic. The only difference is the filename, which is used to demonstrate how naming alone can influence user perception or basic system inspection.
This project is designed to help learners understand:
- How keyboard event listeners work at a low level
- How simple logging mechanisms can be implemented
- Why relying solely on process or filename can be misleading in security analysis
- Captures keyboard input in real time
- Writes captured input into
log.txt - Handles both standard characters and special keys (e.g., Enter, Space)
- Python 3.x
pynputlibrarypyinstaller(for building executable)
Install dependencies:
pip install pynput pyinstallerRun either script:
python keylogger.pyor
python services32.pyBehavior:
- Every key press is printed to the console
- Input is appended to
log.txt - The log file is created automatically if it does not exist
You can convert the script into a standalone executable using PyInstaller:
pyinstaller --onefile --noconsole services32.py--onefile→ bundles everything into a single executable file--noconsole→ runs without opening a terminal window
After building:
- The executable will be located in the
dist/directory - It can be executed without requiring Python to be installed
hello world
this is a test
[Key.backspace]
- Uses
keyboard.Listenerfrom thepynputlibrary - The
on_presscallback is triggered on each key press - Regular characters are written directly
- Special keys are handled via exception logic
.
├── keylogger.py
├── services32.py
├── dist/
└── log.txt (generated at runtime)
- Both scripts are functionally identical
- The naming difference is intentional and used to demonstrate how superficial indicators (like filenames) are not reliable for determining program behavior
- Executables generated with PyInstaller should always be analyzed based on behavior, not just filename or icon
This project is strictly for:
- Personal learning
- Controlled lab environments
- Cybersecurity education
Do NOT use this software:
- On devices you do not own
- Without explicit user consent
- For surveillance or data collection without permission
Unauthorized monitoring of user input may violate privacy laws and regulations.
- Add timestamps to logged input
- Implement log encryption
- Add detection or monitoring techniques
- Compare behavior across different build configurations