Guide
Employee monitoring without keylogging: what to capture and what to leave out
The short answer
Employee monitoring without keylogging means checking that work happened without recording what was typed: count keyboard and mouse events, take low-res or blurred screenshots, log app names and website domains, and only while staff are clocked in. Leave out keystroke contents, webcams, microphones, message contents and anything off the clock.
- Counts
- how many keys and clicks, never which keys
- Clocked in
- the only time anything should be recorded
- 60 days
- AirStaff’s default before screenshots are deleted
Buy once from $99 Try the live demo
60-day money-back guarantee on every direct purchase.
What is the difference between counting keystrokes and logging them?
A keystroke count records that 412 keys were pressed in ten minutes. A keystroke log records which keys: every word of every email, chat message and password typed. The first tells you someone was working. The second tells you everything they wrote.
Some monitoring products log keystrokes. Teramind, for example, describes a keystroke recorder that “captures and logs all keyboard activity”. Others choose not to: Toggl says it does not record keystrokes or take screenshots, and Backlsh’s pricing page says no keystrokes are logged.
AirStaff counts keyboard and mouse events to produce an activity percentage for each ten-minute slot. What was typed is never captured or stored, and there is no employer setting that turns it on.
What should privacy-first monitoring capture?
| Data | Our view | Why |
|---|---|---|
| Tracked time, in slots | Capture | It is what you pay for |
| Keyboard and mouse event counts | Capture | Shows activity without content |
| Active app name and website domain | Capture | Shows what kind of work, not what was written |
| Screenshots, low-res or blurred | Capture, with care | Useful evidence; can show personal details |
| Full page URLs | Think twice | Can reveal searches and personal pages |
| Screen video | Leave out | Far more than a timesheet needs |
| Keystroke contents | Leave out | Passwords, messages and health details |
| Webcam and microphone | Leave out | Records the person, not the work |
| Anything while clocked out | Leave out | Outside the working relationship |
Why leave keystroke logging out?
Three reasons, in order of how quickly they bite.
- It collects things you should never hold. Passwords, bank details, a message to a doctor, a note to a partner. Holding them makes a breach far worse and adds nothing to a timesheet.
- It costs trust. Staff who know every word is logged write less, and look for workarounds. Monitoring that people accept is worth more than monitoring they resent.
- It is still surveillance you must disclose. In New South Wales and the ACT, computer surveillance needs written notice and a policy staff know about, whatever you capture. Capturing less makes that notice easier to write and to defend.
The OAIC notes that the Privacy Act does not specifically cover surveillance in the workplace, but that the Australian Privacy Principles may apply to records of it. The notice rules are in our workplace surveillance notice guide. General information, not legal advice.
How should screenshots work in privacy-first monitoring?
Screenshots are the one capture that can show content, so they need the most care. Three settings matter: resolution, blur and retention.
- Detailed (low-res)
- AirStaff’s default: readable, shrunk to 1024px and compressed to roughly 50–90 KB, never full resolution
- Blurred
- Blurred at the moment of capture, so the readable frame is never written to disk
- Off
- No screenshots at all; time, activity and app usage still recorded
Whatever the mode, staff should see which one is on, and screenshots should not outlive their purpose. AirStaff deletes them after 60 days by default; the employer can set 7 to 180.
What should staff be able to see about themselves?
Everything their manager sees. If a record is fair enough to pay from, it is fair enough to show the person it is about.
In AirStaff, every staff member has a My data view with their own hours, screenshots, activity and consent status, a plain-English list of what is captured, and a one-click download of everything held about them. They can see which notice version they accepted and when.
Is an activity percentage a fair measure of work?
Only as a trend, and only against the person’s own normal. A designer reading a brief, a developer thinking through a problem and an account manager on a call can all show low activity while doing their best work. A script that jiggles the mouse can show high activity while doing none.
Use activity to decide who to talk to, never what to pay. AirStaff’s red flags compare each person with their own average, and idle time is never counted as paid.
Related reading
Sources and how we checked
Vendor statements checked 25 Sep 2026 on each vendor’s own pages.
- Teramind pricing page (plans; prices not shown)
- Third-party figures: WorkTime Teramind review (2026)
- Toggl Track pricing page (plans, no screenshots)
- Backlsh pricing page (Premium plan, screenshots, no keystrokes)
- Dealify listing for Backlsh (lifetime deal tiers)
- DealMirror listing for Backlsh (lifetime deal tiers)
- Teramind: keystroke recorder feature page
- OAIC: Workplace monitoring and surveillance
Teramind, Toggl Track, Backlsh are trademarks of their owners. AirStaff is not affiliated with or endorsed by any company named on this page. No competitor logos or screenshots are used.
Questions people actually ask
Can you monitor employees without logging their keystrokes?
Yes. Counting keyboard and mouse events gives an activity measure without recording what was typed. Add tracked time, app names, website domains and low-res or blurred screenshots, and you can check the work without reading it. AirStaff works this way.
What is the difference between a keystroke count and a keylogger?
A count records how many keys were pressed in a period. A keylogger records which keys, so it captures every word, message and password typed. AirStaff only counts; it never captures or stores what was typed.
Which employee monitoring tools record the keystrokes that staff type?
Some do. Teramind publishes a keystroke recorder feature that it says captures and logs all keyboard activity. Toggl says it does not record keystrokes, and Backlsh’s pricing page says no keystrokes are logged. Ask any vendor directly before you buy.
Are blurred screenshots still useful for checking work?
For most teams, yes. A blurred capture still shows which application and layout was on screen, which answers whether someone was working. If you need to read detail, AirStaff’s default low-resolution mode is readable but never full size.
Should employee monitoring software record full website URLs?
Usually the domain is enough to see what kind of work it was. Full URLs can reveal searches and personal pages. AirStaff records the domain by default, and full URLs only if the employer turns URL tracking on, which staff can see.
Do I still need to give notice if I am not logging keystrokes?
In NSW and the ACT, yes. Computer surveillance of any kind needs written notice at least 14 days before it starts and a policy staff know about. Capturing less makes the notice simpler. This is general information, not legal advice.
Tracking your team can live with, paid for once.
One payment, no renewals, and a 60-day money-back guarantee on every direct purchase.