Every time you tap out a text, search something embarrassing, or type in a password, your phone’s keyboard app is paying very close attention.
According to Kaspersky’s security research, popular keyboards like Google’s Gboard and Microsoft’s SwiftKey actively monitor metadata as you type — things like what language you’re using, how long each word is, exactly when you typed it, and which app you were in when you typed it. That’s not a rumor. That’s documented.
Now here’s the important distinction. There’s a difference between logging metadata (info about your typing habits) and logging the actual words themselves. Major keyboards from Google and Microsoft are known to collect metadata. Whether they’re capturing and transmitting the full raw text of everything you type is less clear — and that’s kind of the problem. You’re mostly just trusting them.
The real danger isn’t necessarily the big names. It’s the random third-party keyboard apps. There are keyboard apps in app stores that function as full keyloggers — meaning they record every single character you type and can send it somewhere else. Passwords. Credit card numbers. Private messages. All of it. And because keyboards need special system permissions to work at all, they have access to pretty much everything you enter on your phone.
So what should you actually do?
Stick to the keyboard that came built into your phone’s operating system — the stock iOS keyboard on iPhone, or your phone manufacturer’s default keyboard on Android (such as Gboard on Google Pixel devices, or Samsung Keyboard on Galaxy devices). These aren’t perfect, but they’re made by large companies with more to lose if they get caught doing something shady, and they’re under more public scrutiny than random third-party apps.
Avoid downloading random keyboard apps, especially free ones that promise crazy features. That’s a classic setup. The app is free because you’re the product.
And for passwords specifically — don’t type them into your regular keyboard at all if you can help it. Use a password manager that fills credentials automatically without you having to type them character by character.
You can also check what permissions your keyboard app currently has. On iPhone, go to Settings → General → Keyboard → Keyboards and look at what’s installed. On Android, the exact path depends on your phone brand — on Samsung devices, try Settings → General Management → Keyboard list and default; on stock Android, try Settings → System → Language & Input → On-screen keyboard. If you see a keyboard you don’t recognize or didn’t intentionally install, that’s worth looking into.