A one-minute test, on your device only
The way you type is almost a signature
Type the password .tie5Roanl ten times: the same one that 51 people typed 400 times each in a Carnegie Mellon University lab. The page measures how long you hold each key and how long you wait between them, draws your rhythm, and then lets you hand the keyboard to someone else. It is an easy signature to forge: with only ten typings, about one stranger in five passes as you.
Each bar is a key held down. The typing in progress is red; earlier ones are grey.
The page sends nothing you type anywhere and keeps nothing after you close the tab.
Your rhythm, drawn
After the tenth typing your rhythm appears here: one ring per key, from the full stop at the centre to Enter at the edge.
Two people from the lab, on their first ten typings:
On a touch screen the page compares you only with yourself. The lab typists used a physical keyboard; the rhythm of taps on glass is a different thing.
Hand the keyboard to someone else
Your profile now holds ten typings. Hand the keyboard to someone near you and ask them to type the password once. Then type it again yourself. After each attempt the page says whether the rhythm looks like yours; you tell it who actually typed.
On the strip below, the red dots in the top row are your ten typings, each compared with the other nine. The dashed line is the threshold: anything left of it passes as you. The grey dots, typings from the lab, were made on a different keyboard, so they usually sit further right than someone typing on your keyboard would.
How reliably does rhythm recognise you?
In a study published in 2009, Kevin Killourhy and Roy Maxion had 51 people type .tie5Roanl 400 times, in eight sessions at least a day apart. An external clock recorded every key press and release. They then tried 14 ways of telling the owner from impostors. The best, by a small margin, was also one of the simplest, and this page uses a version of it: compare each interval with its average and with how much it usually varies.
With a profile built from 200 typings, the method is wrong on average about one time in ten: at the threshold where it rejects the owner as often as it lets a stranger in, both errors are 9.6%. With only ten typings, as here, the same method errs 23%.
The page sets a looser threshold so that you get through most of the time. Rerun on the lab data with each person's first ten typings, this test let the owner through on 88% of their same-day typings and let a random stranger through 23% of the time. The average hides large differences: for half the people fewer than 11% of strangers got through, while for a few, almost any stranger passed.
Rhythm changes with practice
With every typing the password gets easier to type. From the first ten typings to the last ten, the typical person in the lab got 1.4 seconds faster. Over the first ten attempts the fastest typed the password in 1.91 seconds and the slowest in 11.5.
Can any website measure your rhythm?
Yes. Any website you type into learns when you press and release a key without asking for permission; it is exactly the signal used here. The difference is what a page does with it. This one keeps it only in the tab's memory: it sends it nowhere, saves nothing and forgets it when you close the tab or press "Start again".
How the test works
- For every typing the page keeps 21 intervals: how long each of the 11 keys (Enter included) stays down, and the time from releasing one key to pressing the next. When you press the next key before releasing the previous one, that interval is negative; the page calls it an overlap.
- Shift is not timed; R counts as one key, as in the lab. A wrong key, Backspace or a pause longer than five seconds cancels the typing; the lab also discarded typing errors.
- Your profile is the average of the ten typings and the average deviation of each interval, with a floor of 12 milliseconds so that ten attempts do not make it too strict. A new typing gets a score: the mean over the 21 intervals of its distance from your average divided by your deviation (the study's "scaled Manhattan" method).
- The threshold is the ninth of the ten scores obtained when each of your typings is compared with the other nine. So, by the way the threshold is chosen, about one in ten of your own typings falls outside it.
- Lab comparisons use only each person's first session (50 typings), so that beginners are compared with beginners; the "strangers" on the strip are the first five typings of each of the 51. The two lab typists shown next to your drawing are the one whose profile is closest to your average and the one whose profile is furthest.
- The lab used an external clock accurate to 200 microseconds. A browser timestamps events more coarsely, usually to a millisecond or better; some anti-tracking settings round much more, and the page tells you if it notices. Keyboard, chair and tiredness change the rhythm too.
Sources
- Kevin S. Killourhy and Roy A. Maxion, "Comparing Anomaly-Detection Algorithms for Keystroke Dynamics", DSN 2009: the paper and the data set (51 people × 400 typings, freely available for use). The analysis behind this page reproduces exactly the 9.62% average error reported for the scaled Manhattan method.