Can your typing rhythm identify you?

Typing rhythm can help confirm that the person at the keyboard is the one who claims to be typing, but it is a supporting signal, not proof. On the best-known lab benchmark, the top detectors reached an equal error rate of about 10 percent, and that benchmark used one fixed password. Rhythm also changes with fatigue, injury and distraction, and free typing is harder to test. Our typing research guide covers the evidence in full.

Typing rhythm can separate typists in lab tests

Keystroke dynamics is the study of the timing of keystrokes, including how long a key is held and the gaps between keys. The best-known benchmark for it comes from Carnegie Mellon, which recorded 51 people each typing one password 400 times ¹. The timing of keystrokes was used to decide whether a typing sample matched the person who claimed it.

The three top-performing detectors of the 14 tested reached equal error rates of 9.6 to 10.2 percent ². The equal error rate is the point where the share of genuine users wrongly rejected equals the share of impostors wrongly accepted. Lower is better. Roughly one in ten of each kind of error is what the best systems achieved on this data.

The researchers released the data and the evaluation method, so other groups can test their detectors on the same set ³.

The benchmark used one fixed password, which is a narrow test

The benchmark typed one password in a lab. That is a fixed-text test, and it is the easiest version of the problem to measure. The 2013 survey of keystroke biometrics says that user-defined typing is closer to real-world use than fixed text ⁴. The same survey notes that free text makes comparable samples harder to collect, so free-text tests need more data.

So the 10 percent figure describes a controlled, fixed-password case. It does not tell you how well a system would work when you type an email, a chat message or a document.

Typing rhythm changes with fatigue, injury and distraction

The same survey says that keystroke dynamics is less accurate for authentication than other biometric methods, and it gives the reason: the rhythm varies with injury, fatigue or distraction ⁵.

That has a practical consequence. A tired or hurt owner's rhythm may match their stored profile less well, so a genuine user can be rejected on a bad day. A single error rate averages over many sessions, so it does not guarantee the result for any one session.

The method needs little from the user, which explains the interest in it

The survey treats the method's low burden as a main advantage. The survey says the method needs little from the user ⁶. A system can check typing in the background, so a user may not notice the check at all. That convenience is also why the privacy terms matter, as covered below.

The idea is older than the benchmark. In 1990, an abstract by Joyce and Gupta described the stream of gaps between keystrokes as a unique digital signature ⁷. Whether that signature is distinct enough to identify someone is the question that the later benchmarks were built to test.

What to do with this

• Do not rely on typing rhythm alone to decide who is typing. Combine it with a password, a device check or another factor, and treat a mismatch as a reason to ask for more proof.
• When you evaluate a product, ask for error rates on free text as well as fixed text, and ask how the system behaves when the user is tired or hurt. The keystroke dynamics entry explains the terms.
• Check the privacy terms. Typing timing is behavioral data, and the biometric data entry explains why it may count as biometric. The question on whether speech to text collects biometric data covers the related issue for voice.
• Know the limits of identity checks. Whether voice authentication is secure follows the same logic: a biometric is a signal that can be wrong.

The related question on whether typing patterns can detect Parkinson's uses the same timing data for a different purpose, and it has its own caveats. The typing and writing speed overview lists the other guides, and the typing research guide places this question among the others in the set.