LazyKeyboard

LazyKeyboard is a lightweight security keyboard for Android. It replaces the system IME on sensitive fields (passwords, PINs, ID numbers…) with an in-app keyboard, so what the user types never passes through a third-party input method.

中文文档

Letter	Symbol	Number (randomized)	Custom colors

Any installed IME — including third-party ones with full network access — can read every keystroke typed into a normal EditText. For sensitive input, apps in finance, government and healthcare are commonly required to keep input inside the app.

LazyKeyboard shows its own bottom keyboard and inserts characters directly into the field. The system IME is never invoked, and the number pad reshuffles its digits every time it is shown, defeating shoulder-surfing and casual screen recording.

• Drop-in usage — swap EditText for SecurityEditText in your layout. The keyboard shows on focus and hides on blur; the back key dismisses it.
• Hard IME block — the field never creates an InputConnection, so no system keyboard can bind to it, not even via long-press selection or explicit showSoftInput calls from app code.
• Anti-cover pan — if the keyboard would cover the field, the screen content pans up automatically and glides back when the keyboard closes.
• Three layouts — letter / symbol / number with a chooser bar, landscape layouts included.
• Randomized number pad — enabled by default.
• Customizable — chooser colors, chooser and keyboard backgrounds, key preview toggle.
• Pure Java, small footprint — no Kotlin runtime required; only AndroidX appcompat + constraintlayout as transitive dependencies.

• minSdk 23, compileSdk 35+
• v1.7 replaced the rendering layer with a self-drawn view and added the key-input callback (OnSecurityKeyListener) — no breaking API changes.
• v1.6 raised minSdk from 19 to 23 (required by AndroidX). Stay on v1.5 if you must support Android 5.x.

Step 1. Add the JitPack repository to your settings.gradle(.kts):

dependencyResolutionManagement {
    repositories {
        google()
        mavenCentral()
        maven(url = "https://jitpack.io")
    }
}

Step 2. Add the dependency:

dependencies {
    implementation("com.github.onlyloveyd:LazyKeyboard:v1.7")
}

Just use SecurityEditText wherever the user types sensitive content:

<com.gs.keyboard.SecurityEditText
    android:id="@+id/login_input_password"
    android:layout_width="match_parent"
    android:layout_height="wrap_content"
    android:hint="密码"
    android:inputType="textPassword"
    app:chooserBackground="@color/iron"
    app:chooserSelectedColor="#000000"
    app:chooserUnselectedColor="#999999"
    app:keyPreview="true"
    app:keyboardBackground="@drawable/keyboard_bg" />

That's it — no Java code needed. See the app module for a working login-screen sample.

All attributes are optional.

OnSecurityKeyListener reports every key press before it is applied to the field, so you can maintain your own encrypted copy of the input or audit the key sequence:

SecurityEditText editText = findViewById(R.id.login_input_password);
editText.setOnSecurityKeyListener((primaryCode, label) -> {
    if (primaryCode == OnSecurityKeyListener.KEYCODE_DELETE) {
        // delete one char from your own encrypted buffer
    } else if (primaryCode >= 0) {
        // append the character to your own encrypted buffer
    }
});

Functional keys (shift / done / delete) arrive as negative codes — the constants live on the listener interface.

The default chooser labels (字母 / 符号 / 数字) are library string resources. Override title_letter, title_symbol and title_number in your app to localize them.

• The keyboard is rendered by the library's own self-drawn view (SecurityKeyboardView); it no longer depends on the framework KeyboardView that Android deprecated in API 29. Each key owns an independent background drawable instance, so animated selectors no longer corrupt the rendering.
• Because the field rejects all IMEs, IME-driven text composition (and on Android 6–8, clipboard paste via long-press) will not work on SecurityEditText — that is the intended security trade-off.
• This is UI-layer protection: it stops IME capture and casual shoulder-surfing. It does not encrypt input or protect a compromised device — for regulated deployments, pair it with your own encryption of the submitted value.

MIT © 易冬 (onlyloveyd)