Clipboard manager security: what to check before you install one

Clipboard history is useful because it saves copies you might need again. That can include a password, a recovery code, a private message or a screenshot with personal information. Before using a clipboard manager, find out what it captures, where it keeps copies and how you can delete them.

There is no single answer for every app. Some keep history only on your device; others offer cloud sync or backups. A product's encryption and retention settings matter more than the label “clipboard manager.”

Start with the history already on your device

Windows 10 and 11 can keep up to 25 clipboard items when history is enabled. Unpinned items disappear after a restart, while supported text can also sync between PCs if you enable that option. Microsoft's clipboard guide explains the controls.

On macOS Tahoe or later, Spotlight can search recent clipboard history. Apple warns that sensitive information may appear there and provides a Clear History action in the Clipboard view. Earlier macOS versions have Finder's viewer for the current item but no built-in history. See Apple's Spotlight clipboard instructions.

These examples show why you should check the settings on each device before assuming a copied secret vanished.

Five questions to ask before installing an app

1. What does it capture? Check whether the app excludes password managers, secure fields or apps you choose. A sensitive-value detector is useful, but it can miss unfamiliar formats. Avoid copying secrets when you can.
2. Where is the saved history? Look for a clear explanation of local storage, encryption at rest and what protects the key. An encrypted database still becomes readable to someone using your unlocked device or an app session with access.
3. What leaves the device? “Encrypted sync” is more useful when the app explains where encryption happens, who holds the keys and whether a server retains a copy. Transport encryption alone does not answer those questions.
4. How long are clips kept? Check history limits, expiry rules, backups and whether deleting a clip also removes copies on paired devices. A backup can retain content after you clear the active history.
5. Can you verify the controls? Copy harmless test text from an excluded app, then inspect history. Try the delete and restore flows with disposable content before relying on them for sensitive material.

How Clypy handles those questions

Clypy's security overview describes its capture exclusions and secret controls. Copies from configured password managers and content the system marks as concealed are not captured. Newly detected secrets are concealed and excluded from search and agent results; they still sync to your paired devices, end-to-end encrypted and concealed there too, unless you mark them local-only. Detection is not a guarantee that every sensitive string will be recognized, so you can also exclude apps yourself.

The local library is encrypted at rest. During sync, devices encrypt clips before sending them. On the same network they exchange data directly; elsewhere the relay forwards encrypted frames to online devices. The relay does not store a clipboard archive. Optional Drive or iCloud backups are separate encrypted archive files. The technical architecture explains the keys, relay and backup model in detail.

No clipboard tool can protect a secret from someone who already controls your unlocked device. The strongest habit is to avoid capturing it in the first place, then use exclusion and deletion controls for the copies you do keep.