Is a clipboard manager safe?
Over a day your clipboard carries passwords, two-factor codes, API keys, addresses and private messages. A clipboard manager exists to remember that stream, which makes it one of the most sensitive apps on your Mac. Here is what to check before you trust one, ours included.
Updated
What a clipboard manager can see
Everything you copy, in every app, the moment you copy it. It does not see what you type or what is on screen, only what reaches the clipboard. The real question is where that history goes afterwards: to disk unencrypted, to a sync service, or into system search where other apps can read it.
Five things to check
- Where history is stored, and whether it is encrypted. On your Mac and encrypted at rest is the baseline.
- Whether anything is uploaded. Sync is a real feature, but it means your history lives on a server as well.
- How it handles passwords. Password managers mark what they copy as concealed. A careful clipboard manager skips those items.
- App exclusions and a pause switch. You should be able to exclude your banking app and stop recording for a while.
- System search. If clips are added to Spotlight, anything that can search Spotlight can see them. That should be your choice, not a default.
How password managers mark secrets
When a password manager such as 1Password or Bitwarden copies a password, it adds an extra type to the clipboard, org.nspasteboard.ConcealedType, which means “do not keep this”. There is also org.nspasteboard.TransientType for data that should never be stored. The convention, documented at nspasteboard.org, only protects you if the clipboard manager honours it.
How Maclip handles it
- History is encrypted with AES-GCM-256. The key is created on your Mac and kept in your login Keychain.
- Clip content is never uploaded. There is no sync and no account.
- Concealed items are skipped, and 1Password, Bitwarden and Apple Keychain are ignored automatically.
- Any app can be excluded in Settings → Privacy & Security → Ignored Applications.
- Incognito Mode (
⇧⌥I) pauses capture, and Auto-Purge can delete detected API keys and tokens after anything from 5 minutes to 24 hours. - Spotlight indexing is off by default, and detected secrets stay out of it even when you turn it on.
Two things do leave the Mac. When you copy a link, Maclip fetches that page's public preview, which you can switch off. Licence checks send an anonymous installation ID. Privacy settings explained lists every switch.
What no clipboard manager can protect
- An app that copies secrets without marking them concealed looks like any other text. Exclude that app.
- Anyone using your unlocked Mac account can open your history, the same as your notes or your browser.
- Anything copied before the manager was running, or while it was paused, simply isn't there. That part is by design.
Questions
Can a clipboard manager see my passwords?
Only if you copy them. A careful clipboard manager skips items that password managers mark as concealed and lets you exclude apps entirely. Maclip does both and ignores 1Password, Bitwarden and Apple Keychain by default.
Does Maclip upload my clipboard?
No. History is encrypted and stored only on your Mac. The only network requests are link previews (optional), licence checks with an anonymous ID, and update checks.