Your keyboard app can see everything you type. Here is the ten-second check

A keyboard is the one app that sees every password, every one-time code and every message you write. Most of the time that is fine, because the keyboard that came with your phone keeps what you type on the device. A third-party keyboard is different: give it "Full Access" on an iPhone, or install it on Android, and it is allowed to send data to its maker.

Apple says so itself

Apple's own support page is direct about it: a keyboard with full access can transmit anything you type, including things you have typed before, to its developer. That is not a bug. It is how cloud features such as shared dictionaries and online suggestions work.

What researchers found in 2024

In April 2024 the Citizen Lab at the University of Toronto examined the cloud-based input features of nine popular keyboard apps. In eight of the nine, they found weaknesses that let someone on the network read what people were typing. The vendors were notified and several fixed the issues, but the point stands: a keyboard that sends keystrokes to a server is only as safe as that server's code.

The ten-second check

• iPhone: Settings › General › Keyboard › Keyboards. Tap any third-party keyboard and look at Allow Full Access. If you do not trust the company behind it, switch it off, or remove the keyboard.
• Android: Settings › System › Keyboard (on some phones, Languages & input). Remove keyboards you no longer use and check which one is set as default.
• Use your phone's built-in keyboard when typing passwords and bank details.

The general rule

Every app that touches your typing, your clipboard or your screen deserves a second look at its permissions. The fewest apps with the fewest permissions is still the cheapest security there is.