Clipboard security on a Mac

Switch on auto-clear in your password manager

1Password's own writing on the clipboard problem explains its position: prefer AutoFill, and clear the clipboard 90 seconds after a copy. Bitwarden ships the same setting. Open the preferences and confirm it is enabled. A value that leaves the slot on a timer is exposed for a bounded window instead of until your next copy.

AutoFill is the better habit and costs nothing. A password that never reaches the clipboard cannot be read out of it, recorded by a history app, or picked up by anything watching.

Find out what your browser does with a copied password

Firefox made a specific change. Version 94 and ESR 91.3 stopped handing password-field and private-browsing copies to OS clipboard history and cloud sync, tracked as CVE-2021-38505. The copy still lands in your clipboard so ⌘V works. What stops is the handoff to anything keeping a record.

Chrome and Safari publish no equivalent behaviour. Treat a password copied in either one as recordable, and lean on the auto-clear above.

The setting that does the most work in any history app is retention. An item limit or an age limit deletes old secrets for you, which beats remembering to do it. Storage caps help for a different reason: they keep the database from growing until you stop trusting it.

Screen sharing is the case people forget. Before a call, clear the history rather than hoping you do not open the popup by accident. One action, and there is nothing to leak on camera.

Clipboard clippers are real malware, and they are quiet

A clipper watches your clipboard and substitutes what it finds. Copy a wallet address, paste it, and the address in the field belongs to somebody else. The attack works because nobody proofreads 42 characters before hitting send.

This is current. In June 2026, The Hacker News reported a Rust clipper campaign against both Windows and macOS, with a Check Point sample carrying more than 15,500 attacker wallet addresses to substitute.

Defence is dull and it works. Verify the first and last six characters of any address after you paste. Install from the developer's own site or Homebrew rather than a search ad. Once code runs as your user, your clipboard is readable and writable, so the fix sits upstream of any clipboard setting.

Decide what your history keeps, and for how long

Set a limit before you need one. Item count, age, or total size. Old copies are the ones most likely to hold a credential you have forgotten about, and a limit removes them for you.

Exclude your password manager if the app supports it. The exclusion drops copies from that app instead of recording them. Check whether it is on, because it is usually a setting rather than a default.

Leave sync off unless end-to-end encryption is stated in writing. ctrl.blog's per-operating-system matrix records that Windows Cloud Clipboard has no end-to-end encryption, so Microsoft can read synced contents. On the Apple side, Standard Data Protection means Apple stores your keys in its own data centres, and Advanced Data Protection covers third-party CloudKit fields only when the developer marks them as encrypted. Ask the vendor and keep the answer.

Remember Handoff. With Universal Clipboard on, your latest copy is available on your iPhone and iPad. Per ctrl.blog it is end-to-end encrypted and holds only that one item for roughly two minutes, so it is the mildest item here. Still worth knowing before you copy a card number.

What none of this fixes

Physical access beats every setting. Anyone holding your unlocked Mac can scroll the history and read it. A lock screen and a short screen-saver delay do more than any in-app control.

Your backups contain the history. Time Machine and any disk clone include the database. If the clipboard log matters to you, the backup destination matters as much.

A history app makes exposure longer by design. That is the trade you accept by installing one. A password sitting in one slot for four seconds is a narrow risk. The same password in a searchable log stays until something removes it, which is why retention limits and a clear button are not optional.

What I run

Klipto keeps everything in a local database in its own container. No account, no sync, nothing uploaded, and the only network call is an update check you can switch off. I ran a network monitor beside it for an hour and saw zero outgoing traffic. I treat that as the baseline for a tool holding this data, not a selling point.

The exclusion detail deserves plain language: Klipto's password-manager exclusion lives in Settings, then General, and it is off until you switch it on. It does not ship enabled. Turn it on, and copies from your password manager get dropped instead of stored. Retention by age and by total size are separate settings.

Free clipboard managers store locally and cap their history too, so local-only storage is not something I can claim as ours alone.