How to detect a mouse jiggler without spying on the keyboard

A mouse jiggler costs less than lunch, plugs into USB, and keeps a machine reading as "active" all afternoon without anyone touching it. You can detect it without recording a single keystroke: what gives the simulation away isn't what gets typed, but the rhythm of the typing.

If you supervise a fleet, you know the scene. The dashboard says all eight seats are active. Every indicator is green. And yet the queue keeps growing, the tickets don't move, and the work is nowhere to be found. Someone is "present" according to the system and absent according to reality.

The problem isn't a lack of monitoring. It's that traditional monitoring measures the easiest thing to fake: time since last input. Anything that moves the cursor or repeats a key resets that counter. And these days, that "anything" ships for a few dollars.

The three patterns of simulated activity

In practice, nearly all idle-evasion falls into three shapes, and each leaves a distinct fingerprint:

The mouse jiggler. A physical device — or a pad with the mouse sitting on top — that nudges the cursor a few pixels every so often. Its signature: the cursor drifts inside a very small radius, with no clicks and no keystrokes, for a long stretch.

The held-down key. A coin, a paperclip, a pen cap resting on a key. The keyboard goes into auto-repeat and the machine believes someone is typing nonstop. Its signature: input lands on practically every measured instant, while the cursor is dead and nothing is clicked.

The drifting cursor. The subtlest one: the mouse moves — sometimes a lot — but nothing is ever clicked or typed. Real work produces a click or a keystroke every few minutes; continuous motion with zero interaction does not.

Why keylogging is the wrong answer

The obvious temptation is to record keystrokes. Log every key and you'll know whether someone is really typing. It solves the technical problem and creates three much worse ones.

First, legal: under most data-protection frameworks in Latin America and Europe, capturing the content of what a person types is disproportionate to the goal of knowing whether they're working — and disproportionality is exactly what turns otherwise legitimate monitoring into unlawful monitoring. Second, security: a keystroke log eventually contains passwords and customer data. You've just created your company's most dangerous file in order to answer an HR question. Third, human: the day your team finds out — and they will — you lose the trust that made supervision workable in the first place.

Note: this article is informational and does not constitute legal advice. Consult an employment lawyer in your country before rolling out any monitoring policy. See also our guide on whether monitoring your employees' PCs is legal and our responsible monitoring principles.

The alternative: measure the rhythm, not the content

There is one signal that separates a human from a device without ever looking at which key was pressed: input density.

The idea is simple. Instead of storing keys, you count what proportion of the measured instants had keyboard activity at all. A human typing fast — even at a good clip — leaves gaps: between words, between sentences, while thinking. A key in auto-repeat leaves none: it fills essentially every instant.

That's a number between 0 and 1. It contains no text, no passwords, nothing you could read. And it's enough to tell a person typing from an object sitting on a key.

The same applies to the cursor: the geometry of the motion — how far it travels, whether it's confined to a tiny radius, whether anything is ever clicked — separates mechanical drift from a human hand, without recording what was clicked or what was opened.

The real problem isn't detecting — it's not accusing the innocent

Anyone can write a rule that flags "confined cursor". The trouble is it would also flag the person reading a 40-page contract, the one on a call with a hand resting on the mouse, and the one watching a training video.

A false positive here isn't a bad data point on a dashboard: it's an accusation against an employee. So what matters isn't the threshold — it's how long the pattern has to hold before it's worth looking at.

Here's how Argos handles it: each pattern gets its own time bar, and they're deliberately long. A held key needs near-total saturation for about four straight minutes. A jiggler needs two minutes of confined drift without a single click. The drifting cursor — the weakest of the three signals — needs ten minutes of continuous motion, and it resets completely the moment the cursor sits still, because a present human moves in bursts with pauses in between.

One real click, one wide movement, or one natural pause wipes the counter instantly. It's a design built to let doubt through, not to accumulate it.

It's a review flag, not a verdict

This is the most important part, and where most people go wrong when buying a tool like this.

A sustained pattern of simulated activity does not prove anyone is cheating. It proves the machine reported activity that doesn't behave like human activity. It could be a jiggler. It could just as easily be a faulty keyboard, a legitimate automated process, or a misconfigured remote session.

Argos flags it for review and shows it on the machine's timeline, so a supervisor can look at it with context: which application was open, what happened before and after, whether it's the first time or the fifth day running. That conversation belongs to a person, not to a threshold.

It's worth stating what it does not catch, too: a software auto-clicker that sends real clicks and keystrokes to the operating system produces events indistinguishable from a human's at this layer of analysis. Detecting injected input is a different problem, and any vendor promising to catch everything with one checkbox is selling you smoke.

What this actually buys you

With all three patterns covered, the number on your dashboard means something again. "Eight active" means eight people working — not eight idle timers being reset by five-dollar devices.

And you get there without a single keystroke log, without reading anyone's email, and without anything you'd have to hide from your team. Quite the opposite: it's a policy you can announce out loud — "we measure the rhythm of use, never the content" — and one that holds up on its own when someone asks.

That's the difference between monitoring your team tolerates and monitoring that ends in a labor dispute.

See your fleet's real activity

Argos detects all three simulated-activity patterns, without keylogging, with thresholds tuned so nobody gets flagged for reading. Alongside the presence timeline, the screen wall and configurable alerts, in a single console.

See presence detection in the demo · All monitoring features