• SandboxedmacOS limits it to its own container, read-only access to files you copy, and outgoing connections.
  • Notarized by AppleEvery release is signed with a Developer ID and checked by Apple before it ships.
  • Signed updatesEach update’s EdDSA signature is verified before it installs.
  • Open sourceMIT-licensed. Read the code, build it yourself, report what you find.

How it’s built

  • App Sandbox. The app keeps its data in its own container and can’t reach the rest of your files. On top of the sandbox it has three permissions: read-only access to files you copy (kept as bookmarks), read-only access to an app you pick when adding an excluded app, and outgoing network connections, which only the updater uses. It has no access to your camera, microphone, contacts, photos or location.
  • Hardened runtime, Developer ID and notarization. Each release is built by a public GitHub Actions workflow, signed with a Developer ID, and notarized by Apple, which scans it for malicious code. You can check your copy in Terminal.
  • No servers. There’s no Clipboard History account or server, so there’s nothing on the project’s side that could leak your clipboard.

How your history is stored

History is a SQLite database inside the app’s sandbox container:

~/Library/Containers/app.clipboard-history/Data/Library/Application Support/Clipboard History/clipboard.sqlite

The app doesn’t encrypt this file. It’s protected like your other files: by your macOS user account, and by FileVault if it’s on, which encrypts your whole disk. Anyone who can use your account, and any software running as you with access to your files, could read it, just as they could read your browser history.

Deleting a clip removes it from your history at once, and Clear all history also compacts the file and empties its write-ahead log. Words from deleted clips can still stay in the database’s search index, even after Clear all history, and after you delete a single clip, in its write-ahead log too. Deleting the app’s data, as the uninstall guide describes, removes them along with the database. If you use Time Machine, the database is backed up with the rest of your home folder, so clips you delete can remain in older backups.

Passwords and other secrets

Clipboard History never saves what you copy while one of seven password managers is in front: 1Password, Bitwarden, Dashlane, Keychain Access, Apple Passwords, LastPass or KeePassXC. You can add any app in Settings → Privacy → Excluded apps. It also skips clipboard items that the copying app marks as concealed, transient or auto-generated, which is how many password managers flag passwords and one-time codes. The privacy page has the full list.

What it can’t detect

  • It doesn’t detect password fields, Secure Input or the lock screen; it only sees what lands on the clipboard.
  • It can’t tell a password, token or private message from other text. A secret copied as ordinary text from an app that isn’t excluded is saved like anything else.
  • Excluded apps are matched by the app in front when the copy is noticed, not by the program that copied. A password manager’s browser extension copies while your browser is in front, so it’s skipped only if it marks the copy as concealed. The same applies to pbcopy in Terminal.

So before copying something sensitive from an app that isn’t excluded, use Pause For in the menu bar, or add that app to Excluded apps.

Permissions

The only permission Clipboard History asks for is Accessibility, for auto-paste. It asks when you click Enable… during setup or, if you skipped that, the first time you choose a clip, and you can decline. It uses it to send to the app you were using right after you choose a clip. Without it, recording, searching and copying all work, and you press yourself.

Review or remove it in System Settings → Privacy & Security → Accessibility. The app doesn’t ask for Full Disk Access, Input Monitoring or Screen Recording.

Updates

To see whether there’s a new version, choose Check for Updates… in the menu bar. The app then uses Sparkle to read the update feed in the GitHub repository and, if you choose to install a newer version, download it from GitHub Releases. Every update is signed with the project’s EdDSA key; the matching public key is built into the app, and Sparkle refuses an update whose signature doesn’t match.

If installing that way from version 0.0.27 fails, update by hand: download the latest version and drag it over the old app in Applications, and your history stays. Apart from the update check, the app makes no network connections; the privacy page has the details, including what this website measures.

A practical checklist

  1. Use a strong login password, and lock your Mac when you step away.
  2. Turn on FileVault.
  3. Review Settings → Privacy → Excluded apps, and add the apps you copy secrets from at work, such as SSH or database clients.
  4. Keep the history size to what you actually use. Settings → Storage counts clips, not days.
  5. Pause recording before copying something sensitive.
  6. Before lending, selling or handing over your Mac, remove the app’s data as the uninstall guide describes; Clear all history can leave words in the search index.
  7. Check for updates now and then.

Check it in the source code

Clipboard History is open source, so what this page says can be checked on GitHub:

Report a security problem

Open an issue on GitHub Issues. If publishing the details could put people at risk, describe the problem without them and ask for a private way to share the rest.