xkbcat

Simple X11 keylogger.

Simple output format: One line on stdout per key event.
Simple to audit: One short file of modern C.
Simple to run: Does not need sudo.

Examples

Keypresses only

Given no options, xkbcat prints only keypresses, one per line. Here's the output when I type "Hi":

Shift_L
h
i

Keypresses and key-ups

With key-ups enabled (xkbcat -up), the format changes to show them:

+Shift_L
+h
-h
-Shift_L
+i
-i

Lines starting + are key-downs; - are key-ups.

Compilation

Just make.

Don't have X11/extensions/XInput2.h? Install your distro's libxi-devel package.

Usage

Options you can pass (all optional):

-display <display>: set target X display (default :0)
-up: also prepend key-ups (default: don't)
-help: print usage hints and exit

Then just use your computer as usual. Interrupt signal (C-c) to quit.

Related programs

Other keyloggers

If you need to log keys across a whole Linux system (also in the
framebuffer—not just in X11), try keysniffer. It works via a kernel
module, and needs sudo.
If you want to see what characters the user actually typed (with modifier
keys, backspace, etc resolved into text), xspy or logkeys
might be better for you.

Programs that work well together with `xkbcat`

If you want to add timestamps to each line for logging purposes, I recommend
piping to the moreutils package's ts. These answers feature
various other tools good for the purpose.
If you only want to see key names when you press keys in the same terminal
where xkbcat is running, you can temporarily disable terminal echo with
stty -echo && xkbcat. (stty is in coreutils.)

Programs for logging other X11 events

xinput invoked as xinput --test-xi2 --root logs everything input-related; even mouse movements and clicks, and touchpad stuff. Its output is very comprehensive, but harder to parse.
If you need to log X11 events more generally, various protocol monitoring programs are listed in the X11 debugging guide.

Versioning

The git-tagged version numbers follow semver.

Error outputs (on stderr) are intended to be read by people. Changes to their wording are not considered breaking changes. Don't parse them programmatically.