Can keyboard apps steal your passwords?

Every keyboard sees what you type. Here is exactly what Keyboardy sees, what it sends to our server, and what it never touches — on iPhone and Android.

Can any keyboard see what I type?

Technically, any keyboard you install sees what you type with it, because every character passes through it before it reaches the app. That is why both platforms put limits on keyboards. On iPhone the system swaps any third-party keyboard for its own in password fields, and a keyboard cannot reach the internet unless you grant it Allow Full Access. Android shows a warning when you enable any third-party keyboard that it may collect what you type, and then leaves it to the keyboard to decide how it treats password fields. So the real question is not whether a keyboard can see, but what it does with what it sees, and whether it tells you plainly. This page answers that for Keyboardy, in detail.

Does Keyboardy see the passwords I type?

On iPhone, no: the system itself takes Keyboardy out of password fields and puts its own keyboard in its place. On Android you do type into those fields with Keyboardy, because it is the active keyboard, but it reads nothing from them: it sends no search query from them, suggests no words and learns nothing. On Android that protection covers every kind of password field, number, phone and date fields, email addresses, web addresses, and any field where the app asks the keyboard not to learn from typing, such as incognito browser tabs. Keyboardy checks the field type every time it reads or sends text, so when you move from a chat box into the password field beside it, it stops at once.

What exactly does Keyboardy send over the internet?

It sends one thing from what you type: a search query to find videos, stickers and GIFs that match what you are saying, and only while the media row is showing above the keys. The row appears automatically when you are online. On iPhone the query is the last three words before the cursor, letters only, never numbers or symbols, and nothing at all is sent unless you have turned on Allow Full Access. On Android it is up to the last 512 characters of the field you are typing in, as typed, sent once you pause for half a second, and nothing is sent if the text is shorter than three characters. The request carries your account token so your favourites can be marked in the results, and our server works out your country from the connection to rank what is trending there. Nothing is sent from the protected fields listed above.

Does Keyboardy store what I type?

We do not log keystrokes or store the text of your conversations, and there is no record of what you type on our servers. Search queries reach the server so it can answer them, and we do not keep them afterwards or link them to your account. The one exception: if a request fails because of a server error, its details, including the search query, may be kept in the error logs we use to fix the fault. Word suggestions and autocorrect run on your device, from dictionaries stored on it, and the words Keyboardy learns from how you type stay on your device and are never sent to us. That is why correction works offline, and why our server knows nothing about the words you type between search queries.

Why does iPhone ask for Full Access, and is turning it on risky?

Without Allow Full Access, iPhone blocks any third-party keyboard from the internet and from the clipboard, and when you turn it on the system shows a general warning that the keyboard could send what you type. That warning appears for every third-party keyboard; it does not describe what any particular keyboard does. Keyboardy needs the permission for two things: fetching media from the server, and copying a video or sticker to the clipboard so you can paste it into the chat. What it sends with it is only what is described above: the last three words, letters only. If you leave it off, Keyboardy still works for typing in Arabic and English with diacritics and word suggestions, and nothing is sent from it. You can turn it off at any time in your keyboard settings.

How do I stop anything being sent, or delete my data?

Hide the media row and nothing is sent while it is hidden. On Android you can switch the row off completely from the options menu that opens when you hold the media key, and it stays off until you turn it back on. On iPhone, turning off Allow Full Access stops every internet connection from the keyboard, while typing and correction keep working. You can ask us to delete your account and everything attached to it by writing to the support address, and deleting the app on its own stops anything further being sent to the server. You never needed an email address or phone number in the first place: Keyboardy starts with a guest account created from your device identifier. The full legal detail is in the privacy policy.

How can I tell whether any keyboard is safe?

Ask four questions about any keyboard before you trust it. Does it say specifically what it sends and what it does not, rather than general lines such as "your data is safe"? Does it work for ordinary typing without Full Access on iPhone? Does it stop reading in password and email fields on Android? And do you know who makes it and how to reach them? Avoid keyboards from unknown sources or from outside the official stores, because nothing reviews them. Keyboardy answers all four questions on this page, with the numbers, and it is made by BeInMedia; you can reach us from the support page. If a keyboard cannot answer these questions as plainly, that tells you something too.

Read the full privacy policy

Try Keyboardy

Free, Arabic and English, on Android and iPhone.