Is a keystroke display safe? What it can see and what it keeps
A keystroke display is as safe as the app behind it. To light up your keys it has to see them, which is the same access a keylogger would use, so the real question is what the app does with what it sees. Typebar shows each key and keeps nothing: nothing you type is saved or sent anywhere, typing in fields macOS marks as secure never shows, and its one permission is Accessibility. You do not have to take any app’s word for this, though, and the last part of this post shows how to check.
What any key display can see
On a Mac, an app cannot see the keys you press in other apps unless you allow it. Two permissions in System Settings > Privacy & Security open that door:
- Input Monitoring, which macOS describes as letting apps “monitor input from your keyboard even while using other applications”.
- Accessibility, which macOS describes as letting apps “control your computer”. It covers seeing keys, and a good deal more.
A key display needs one of the two, because showing your keys is impossible without seeing them. Once it has that access, it can see what you type almost everywhere: messages, documents, search boxes, the address bar, the commands you type in Terminal. It can also tell which app is in front.
There is one big exception. When you type into a password field that macOS marks as secure, macOS turns on secure input and keeps those keys away from every other app, key displays included. The protection comes from macOS itself, so it does not depend on the key display behaving well. Secure input on a Mac explains when it turns on and why some apps go blank because of it.
So a key display sees most of your typing. That is not a flaw in any particular app; it is the job. What separates a safe one from a risky one is what happens to the keys next.
What Typebar sees, and what it keeps
Typebar uses its one permission, Accessibility, for three things: to see which keys you press, to read the menus of the app in front so it can name each shortcut, and to type for you when you use Click to Type. It does not ask for Screen Recording or Input Monitoring.
What happens to each thing it sees:
- Your keys light the board and appear in the pill, and that is where they stop. Nothing you type is saved or sent anywhere.
- App menus give shortcuts their names, such as “⇧⌘4 Screenshot Selection”. The names come from the app’s own menus, not from your documents.
- Your clicks and the pointer drive the click ripples, drag trail, halo and Spotlight, which show on screen and in recordings.
What it does keep is your setup: settings, themes, cheatsheets and layers, so they are there next time. It checks for updates once a day, and you choose when to install them.
Typebar’s privacy page lists everything it reads, everything it keeps and what goes online, in more detail than fits here.
Where it stays quiet
Keeping nothing covers what is saved. What shows on screen matters too, because during a recording or a screen share, the overlay itself is something other people see. Typebar has several ways to show less:
| Situation | What shows |
|---|---|
| A password field macOS marks as secure | Nothing typed; the pill says “Typing hidden in a password field” |
| 1Password, Bitwarden, Keychain Access or Passwords in front | Nothing typed; shortcuts and special keys still show |
| An app you add to “Hide typing in these apps” | The same as above |
| “Hide letters” turned on | Shortcuts and special keys; letters show as dots |
| Paused from the menu or the Pause shortcut | Nothing at all, until you choose Resume |
The hidden-apps list, Hide letters and Pause live in Settings > Privacy. Hide letters suits live demos, where a slip into the wrong field would otherwise show on the board. Pause is for the moment you know is coming, such as a login you cannot avoid on camera. Show keys in a recording without leaking a password goes through the risky spots one by one, and Hide what you type but keep shortcuts visible compares the settings.
How to check any app’s claims
A privacy promise is only words. These checks use what is already on your Mac and work for any app that sees your keys.
1. Look at its permissions. Open System Settings > Privacy & Security and look at Accessibility, Input Monitoring and Screen Recording (called Screen & System Audio Recording in macOS 15 and later). An app that shows keys has a reason to be in one of the first two. If it is also in Screen Recording, it can see your screen, and it should have a clear reason. Turn off anything an app has no need for.
2. Check who made it. In Terminal, run:
spctl -a -vv /Applications/Typebar.app
swapping in the path of the app you are checking. A signed and notarized app shows accepted, source=Notarized Developer ID, and an origin= line naming the developer. Notarization means Apple checked the app for known malware. It is not a review of what the app does with your data, so treat it as a floor, not a guarantee.
3. Watch its network use. Open Activity Monitor, click the Network tab, and find the app in the list. Type for a few minutes in another app and watch its Sent Bytes. A key display that sends what you type would have to send it somewhere, and steady growth while you type is worth asking the developer about. An outgoing firewall such as LuLu or Little Snitch goes further and asks you before an app connects to anything.
4. Look at what it writes. Apps keep their files in ~/Library/Application Support and their settings in ~/Library/Preferences. In Finder, choose Go > Go to Folder, type the path, and look for the app’s folder or settings file. Settings and themes are expected. Anything that grows as you type, such as a log or a history file, is not.
5. Read the privacy policy. A good one says plainly what the app reads, what it keeps, where it keeps it and what it sends. Vague lines like “we respect your privacy” with no specifics tell you nothing.
Habits that help with any key display
- Download from the developer’s own site or the Mac App Store, and check the signature as above.
- Clear out old permissions. In Privacy & Security, remove apps you no longer use from Accessibility and Input Monitoring. An app you deleted months ago has no business on that list.
- Show it only when you need it. A key display does not have to sit on screen all day. In Typebar, “Show when a screen recording starts” in Settings > Recording brings the overlay up while you record or share and hides it after.
- Use a demo account for recordings. No overlay setting beats having nothing real to leak.
Questions
Is a keystroke display a keylogger?
It uses the same access a keylogger would. The difference is what happens to the keys: a key display shows them and should keep nothing, while a keylogger records them. That is why the checks above matter.
Does Typebar see my passwords?
Not in fields macOS marks as secure. Secure input keeps those keys from it, and the pill says “Typing hidden in a password field” instead.
Does Typebar need Screen Recording permission?
No. Its only permission is Accessibility. Why a keyboard overlay needs Accessibility permission explains what that one permission is used for.
What does Typebar keep?
Your settings, themes, cheatsheets and layers. Nothing you type is saved or sent anywhere.