This paper describes the security research for a web application designed by BehavioSec. The application uses JavaScript to record keystrokes to generate data that is sent back to a server for verication. As this type of applications are often used in systems used for sensitive data, they are often targets for various attacks. The purpose of this paper is to decide what can be done to, if not prevent these attacks, then at least make it more dicult to succeed with an attack.Information has been gathered through web research, mainly based on the current programming languages that are being used in the application but alternatives has also been taken into consideration. Requests from BehavioSec has also been evaluated.There are many ways to increase the security around these kinds of applications. Web replay attacks could be countered by generating a JavaScript on the server side for each user that has the same functionality but with a dierent format each time. One way to prevent man in the browser attacks could be to use a verication based on the performed request from the client. Hashing the data could also help verify that the data has not been altered since it was transmitted from the client to some extent. To increase the security further a salt could be used with the hash function. No matter what solution is used, the use of sessions is recommended as it enable the possibility to store sensitive data on the server side instead of passing it to the client.