Abstract: A data stream generated by a user operating a human-computer interface (HCI) is obfuscated, or “scrambled,” for keylogging prevention. Obfuscating the data stream generated by the user comprises, by a web browser, setting a hook for intercepting keypress events. Keypress events comprise user input events into the first HCI or virtual keypress events. Based on capturing a keypress event corresponding to a first keypress code that triggers the hook, the web browser scrambles the first keypress code to generate a second keypress code that differs from the first keypress code. Scrambling the first keypress code comprises changing, salting, or skipping the first keypress code to generate the second keypress code.