What Keystroke Timing Reveals (and What It Doesn't)

People type with a rhythm. There are bursts and pauses, corrections and backspaces, a cadence that varies with how hard they're thinking. Pasted text has none of that. It arrives all at once. That difference, measured from timing alone, is one of the most privacy-friendly integrity signals available.

The shape of real typing

Genuine answers build unevenly: a few words, a pause to think, a correction, another burst. The inter-keystroke intervals form an irregular pattern. A block of text that appears in a single instant, or a steady, machine-even stream of characters, looks nothing like a human working through a problem.

What it can flag

• Pasted answers. Long, well-formed text appearing without the typing that should precede it.
• Dictated or relayed input. A read-then-transcribe cadence where the person types what they're hearing.
• Injected input. Synthetic keystrokes with unnatural, too-regular spacing.

Why timing matters in coding and written-response interviews

Keystroke timing is especially useful when the candidate is expected to produce original work live. In a coding screen, a system-design write-up, or a structured written answer, the typing pattern should broadly match the difficulty of the task. Long pauses followed by fully formed text can be legitimate, but when they cluster around question prompts and other suspicious signals they become highly informative.

What timing analysis should never be used for

Timing is not a lie detector. It should not be used to rank candidate confidence, infer emotion, or penalize people who type slowly, use assistive technology, or write in a second language. The only valid use here is much narrower: distinguishing independently produced work from pasted, dictated, or injected input during a monitored interview.

What it deliberately can't do

Timing analysis works on when keys are pressed, not which keys. It never sees the words. That's a feature, not a limitation: it keeps the signal privacy-preserving, as we cover in consent-first monitoring. It also means timing is a contributor, not a verdict, a fast, fluent typist isn't cheating, so timing is weighed alongside other signals rather than acted on alone.

How recruiters should interpret a timing signal

On its own, a timing anomaly should trigger curiosity, not a conclusion. The right next step is to look at the full report: did a large paste happen at the same moment, did focus move off the interview window, or did a hidden overlay appear? Timing earns its value when it helps confirm a broader pattern, not when it is treated as standalone proof.

Why timing is useful only in context

Typing timing is a supporting signal, not a mind-reading tool. Human typing has starts, stops, corrections, bursts, hesitations, and uneven rhythm. Generated or injected text often arrives in smoother blocks, with little editing and unusual timing around the prompt. That difference can be useful, but only when it is connected to the interview timeline and other technical events.

For example, a long pause followed by a complete paragraph may be normal in a reflective behavioral answer. The same pattern after a coding prompt, combined with a focus change and a large paste, is more meaningful. Timing analysis should help reviewers ask better questions of the evidence. It should never be treated as proof by itself.

Accessibility and fairness considerations

Typing patterns vary widely. Disability, injury, keyboard layout, language familiarity, nervousness, and assistive technology can all change cadence. A fair system must avoid scoring people against a single idea of "normal typing." It should look for event-level anomalies, such as instant insertion, automated uniformity, or timing clusters around external activity, rather than judging a candidate's natural speed.

This is also why content should stay out of scope. The system does not need to know what the candidate typed to understand whether the input arrived manually, as a paste, or through a suspicious injection pattern. Keeping the signal metadata-only makes the approach more privacy-preserving and easier to defend.

Reviewer checklist

• Was the timing signal connected to a specific question, paste event, or focus change?
• Could the pattern be explained by accessibility tools, nerves, or normal editing?
• Did the interviewer observe answer ownership in follow-up questions?
• Does the report show enough context to support a decision?

Examples of timing patterns reviewers can understand

A normal answer often has visible composition: short bursts, pauses, deletions, corrections, and uneven sentence construction. A suspicious answer may show a long inactive period followed by a large paste or a smooth block of input with little editing. In coding interviews, suspicious timing may include no exploratory typing, then a complete function arriving at once.

These examples are not verdicts. They are patterns that become meaningful when connected to the prompt and other signals. If the candidate was asked a conceptual question and paused to think, that is normal. If the candidate switched focus, waited, pasted a polished answer, and then struggled to explain it, the timing signal helps tell the story.

The reviewer should always be able to read the report and understand the pattern without seeing the candidate's private text. That is the standard for privacy-preserving timing analysis.

How timing connects to follow-up questions

When timing looks unusual, the best live response is a follow-up that tests ownership. Ask the candidate to modify the answer, explain a tradeoff, or debug a small variation. If the original answer was genuinely theirs, the follow-up usually produces useful detail. If the answer came from an outside source, the explanation often becomes generic or disconnected from the code or claim.

This is why timing signals should be available to reviewers and, where appropriate, to interviewers in a calm way. The signal should guide better questioning, not trigger instant judgment.