Keystroke Biometrics That Spot the Swap

Q: Does keystroke biometrics log what candidates type?

The biometrics model needs timing data — dwell, flight, and key-pair transitions — not content. Content and timing are handled with separate retention policies; biometrics can work on timing metadata alone.

Q: How long does it take to build a baseline?

About 60 seconds of natural typing. Shorter for simple short-form questions; longer for extensive code editing. The classifier is disabled until a reliable baseline is established.

Q: What if the candidate is a slow typist or types unusually?

The baseline is personalized — the classifier models that specific candidate, not an average typist. Slow, fast, one-finger, or unusual rhythm all work as long as the session is consistent.

Q: Can keystroke biometrics catch AI-generated typing?

Kind of — paste events are a separate signal, and LLM-assisted candidates often paste large chunks, triggering the paste detector. Direct AI-driven typing (simulating a human) is harder but shows up as unnatural rhythm patterns.

Q: Is keystroke biometrics compliant with privacy laws?

Keystroke timing metadata is typically considered behavioral biometrics. ClarityHire supports clear consent, configurable retention, and deletion workflows to align with GDPR, BIPA, and similar regulations.

An XGBoost classifier models a candidate's typing rhythm in the first minutes — then detects when a different person takes over the keyboard. Invisible, continuous, and accurate.

Start Free Trial See Pricing

XGBoost

Trained classifier

< 60s

To build the baseline

Continuous

Monitoring throughout

Invisible

To the candidate

Typing rhythm is a fingerprint

And ClarityHire is trained to recognize it, mid-assessment, every keystroke.

XGBoost classifier

A gradient-boosted model trained on timing features — dwell times, flight times, n-gram patterns.

Dwell and flight timing

Millisecond-accurate measurements of key-down, key-up, and inter-key transitions.

Baseline profiling

First 60 seconds establish a typing-rhythm baseline — the signature for the rest of the session.

Continuous monitoring

Every subsequent keystroke is scored against the baseline. Abrupt changes trigger alerts.

Paste event detection

Distinguishes typed content from clipboard pastes — paste events are separate signals.

Per-signal integrity score

Keystroke confidence folds into the unified authenticity score with timestamps and replay.

Hashed storage

Keystroke timing metadata stored; actual content is separated and retention-controlled.

Browser-native

Works via keyboard events in any modern browser. Zero install, zero extension.

Audit trail

Every rhythm anomaly timestamped with confidence score — exportable for review.

Built for how modern teams hire

The science

Everyone types differently

Dwell times (how long you hold a key) and flight times (how quickly you move between keys) are as distinctive as handwriting. After 60 seconds of typing, ClarityHire has a signature — and it does not match anyone else's.

Dwell time distributions per key
Flight time distributions per transition
N-gram pattern analysis

Catch the swap

When someone else takes over, typing rhythm changes

Proxy test-takers and mid-session swaps change typing rhythm noticeably. The classifier catches the shift and timestamps the event for review.

Continuous scoring against baseline
Alert threshold configurable per role
Timeline shows the exact moment of change

Privacy-aware

Timing metadata, not content logging

Keystroke biometrics need timing, not content. Metadata (dwell, flight, transitions) is stored for integrity scoring — content is stored separately with its own retention policy.

Timing metadata separated from typed content
Configurable retention per data type
Candidate consent and audit log included

How it works

Candidate starts typing

First 60 seconds build the rhythm baseline — dwell, flight, and n-gram distributions.

Classifier activates

Baseline loaded into XGBoost. Every keystroke now scored against the model.

Anomalies flagged live

Rhythm changes detected. Alerts fire to the interviewer dashboard immediately.

Review with evidence

Integrity report shows exact timestamps of rhythm changes with confidence scoring.

Frequently asked questions

Does keystroke biometrics log what candidates type?+

The biometrics model needs timing data — dwell, flight, and key-pair transitions — not content. Content and timing are handled with separate retention policies; biometrics can work on timing metadata alone.

How long does it take to build a baseline?+

About 60 seconds of natural typing. Shorter for simple short-form questions; longer for extensive code editing. The classifier is disabled until a reliable baseline is established.

What if the candidate is a slow typist or types unusually?+

The baseline is personalized — the classifier models that specific candidate, not an average typist. Slow, fast, one-finger, or unusual rhythm all work as long as the session is consistent.

Can keystroke biometrics catch AI-generated typing?+

Kind of — paste events are a separate signal, and LLM-assisted candidates often paste large chunks, triggering the paste detector. Direct AI-driven typing (simulating a human) is harder but shows up as unnatural rhythm patterns.

Is keystroke biometrics compliant with privacy laws?+