Keystroke dynamics, sometimes called typing biometrics, measures how you type rather than what you type. Two people entering the identical password produce measurably different timing signatures: how long each key is held down (dwell time), the gap between releasing one key and pressing the next (flight time), and the characteristic slowdown around specific digraphs, like the pause many typists show before "th" or after a capital letter requiring the shift key. Research in this area goes back decades, originally aimed at telegraph operators whose individual "fist" was recognizable to colleagues on the same line. The modern version runs in JavaScript, in the background, on almost any page with a text field.
How the Measurement Actually Works
A script listening for keydown and keyup events can build a timing vector for anything typed into a page: a login form, a search box, a comment field. Each keystroke contributes dwell time and inter-key latency; over a string of even a dozen characters, the resulting pattern is distinctive enough that classifiers built on it report accuracy figures in the range typically associated with fingerprint or iris matching in controlled studies. The pattern is stable across sessions for a given person and a given input device, though it shifts meaningfully between a physical keyboard and a phone's on-screen keyboard, and it degrades with fatigue, injury, or a genuinely different keyboard layout.
Canvas and font fingerprinting identify your device or browser configuration, which changes when you switch machines or update software. Keystroke dynamics identifies a motor pattern in your hands. It survives a new device, a new browser, a cleared cache, and a fresh account, because none of those touch the thing being measured.
Who's Actually Deploying This
The dominant commercial use case is continuous authentication for fraud and bot detection: banks and e-commerce sites use keystroke and mouse-movement telemetry to distinguish a human from a credential-stuffing script or a remote-access-trojan operator typing on a victim's behalf, without adding a visible second factor. That's a legitimate, narrowly scoped fraud-prevention use, and it's the one vendors lead with in their marketing.
The broader concern is scope creep into general-purpose tracking and deanonymization. Because a typing signature is largely independent of the browser fingerprint, IP address, or cookie state that most privacy tools already target (see our piece on browser fingerprinting if you're building a mental model of the layers), it can in principle link two sessions that were otherwise carefully separated: a "clean" anonymous account and a personal account, if both were typed on the same keyboard by the same hands. It's the same underlying idea as stylometric authorship analysis, applied at the level of motor behavior instead of word choice, and it doesn't require the target to write more than a sentence or two.
What the Research Actually Shows, and Where It Breaks Down
It's worth being precise about the limits, because keystroke dynamics gets oversold in both directions: as either a perfect surveillance tool or a non-issue. Accuracy numbers from academic datasets are usually collected under controlled conditions (same keyboard, same session length, cooperative subjects), and they degrade substantially with mixed input devices, short text samples, or subjects who aren't touch-typing consistently. A typing signature captured from a ten-character password field is far weaker evidence than one captured from three paragraphs typed into a comment box. Cross-device matching (phone versus laptop versus a different physical keyboard) is measurably harder than same-device matching across sessions.
| Condition | Effect on match confidence |
|---|---|
| Same physical keyboard, multiple sessions | High confidence, hardest to defeat |
| Longer free-text sample vs. short password field | Confidence rises sharply with sample length |
| Switching between physical and on-screen keyboards | Confidence drops significantly |
| Deliberately varied typing rhythm | Degrades matching, though inconsistently |
The Legal Status Is Inconsistent
Whether keystroke dynamics counts as a regulated biometric identifier depends entirely on jurisdiction, and the inconsistency is itself worth knowing. Illinois's Biometric Information Privacy Act (BIPA), the strictest state-level biometric law in the US and the source of several large class-action settlements against fingerprint and face-scan systems, defines biometric identifiers narrowly enough (retina/iris scan, fingerprint, voiceprint, hand or face geometry) that keystroke and mouse-movement telemetry generally falls outside it, a gap privacy litigators have flagged repeatedly without a definitive court ruling closing it. The EU's GDPR takes a broader, principle-based approach: biometric data used "for the purpose of uniquely identifying a natural person" is a special category requiring explicit consent, which arguably does capture keystroke dynamics deployed for identification rather than fraud scoring, though enforcement guidance specific to this exact technology is still thin. The practical upshot is that a company using keystroke telemetry purely for fraud detection, and disclosing that use in a privacy policy nobody reads, faces meaningfully less legal exposure than one using the identical technology to build cross-site identity profiles, even though the underlying data collection looks the same from the user's side.
What Actually Reduces Exposure
There's no clean technical fix equivalent to a VPN or a hardened browser profile, because the thing being measured is behavioral rather than configurational. A few things do move the needle. Voice-to-text or on-screen keyboards produce a different, weaker signal than physical touch-typing, which is part of why cross-device matching is harder. Browser extensions exist that inject artificial jitter into keystroke timing before it reaches the page's JavaScript listeners; they help against naive classifiers but haven't been shown to defeat well-trained ones consistently, since randomized noise is itself a detectable pattern if it's too uniform. The most reliable mitigation is contextual: treat any account where linkage to your identity is a real risk (whistleblowing, sensitive research, adversarial reporting) as requiring a genuinely separate physical setup, not just a separate browser profile, for exactly the reason covered in our whistleblower OPSEC guide.
The uncomfortable property of behavioral biometrics is that "clearing your data" doesn't clear the data. The signature isn't stored on your device to begin with. It's in how your hands move, and that travels with you by default.
Where This Sits in a Broader Threat Model
For most people, most of the time, keystroke dynamics is a fraud-prevention layer they'll never notice and don't need to worry about. It becomes relevant specifically at the intersection of high-stakes anonymity and JavaScript-heavy web platforms: a journalist maintaining a source-facing pseudonymous account on the same laptop as their byline account, for instance. The mitigation there isn't a browser setting, it's operational separation, the same discipline that already governs which device touches which identity.
Haven's chat and email don't reduce your exposure to page-level behavioral tracking on other sites; nothing running inside a third-party browser tab can. What it does is keep the content of what you send end-to-end encrypted regardless of what a page-level script running elsewhere might infer about who's typing. Different layer of the threat model, and worth knowing which layer you're actually defending.