They'd need to detect and store your keystrokes. If you have JavaScript enabled that's trivial, but hopefully you have JavaScript disabled.