What Keystroke Timing Reveals (and What It Doesn't)

People type with a rhythm. There are bursts and pauses, corrections and backspaces, a cadence that varies with how hard they're thinking. Pasted text has none of that — it arrives all at once. That difference, measured from timing alone, is one of the most privacy-friendly integrity signals available.

The shape of real typing

Genuine answers build unevenly: a few words, a pause to think, a correction, another burst. The inter-keystroke intervals form an irregular pattern. A block of text that appears in a single instant — or a steady, machine-even stream of characters — looks nothing like a human working through a problem.

What it can flag

• Pasted answers — long, well-formed text appearing without the typing that should precede it.
• Dictated or relayed input — a read-then-transcribe cadence where the person types what they're hearing.
• Injected input — synthetic keystrokes with unnatural, too-regular spacing.

What it deliberately can't do

Timing analysis works on when keys are pressed, not which keys. It never sees the words. That's a feature, not a limitation: it keeps the signal privacy-preserving, as we cover in consent-first monitoring. It also means timing is a contributor, not a verdict — a fast, fluent typist isn't cheating, so timing is weighed alongside other signals rather than acted on alone.