The clipboard is the most under-discussed attack surface on the average desktop. It is a shared, persistent, cross-application memory region that holds whatever you last copied — often a password, a one-time code, an API key, or a snippet of a confidential document — and it stays there indefinitely. Any application you launch afterwards, any browser extension with the clipboardRead permission, and any script running on a focused page can read it. This guide explains what is happening inside the clipboard, when that becomes a real risk, and how to clear it programmatically from a web page.
Why clipboard contents linger
Every desktop OS maintains a global clipboard store. On Windows this is the old Clipboard Viewer chain, modernised into a format-registry API. On macOS it's NSPasteboard. On Linux it's a mix of X11 selection buffers and Wayland clipboard protocols. In all cases, when an application writes to the clipboard it provides a set of representations keyed by type (see the MIME types guide). When another application reads, it picks the representation it understands.
Nothing in any of these APIs automatically expires clipboard contents. A password you copied from a password manager at 9:00 AM is still there at 5:00 PM unless something else has since been copied. Some operating systems (notably iOS and iPadOS) display a small banner when an app reads the clipboard, which has exposed how aggressively some apps poll. But the data itself is not cleared.
Where this becomes dangerous
- Paste targets drift. You copy a password to sign into a banking site, then switch windows to answer a chat message. Your cursor is now in the chat input. You paste — into the chat. On some chat platforms the default preview immediately shows the pasted text, meaning you have just leaked a password to your entire team.
- Browser extensions with too many permissions. Extensions that declare
clipboardReadcan, in principle, read the clipboard from any tab they have host permission for. Extensions vetting is patchy, and extensions change ownership. - Screen-share leaks. Some paste targets echo content to the screen for a few hundred milliseconds before replacing it — during a screen-share, those few hundred milliseconds are enough for a password to appear on someone else's recording.
- Multi-user machines. A shared desktop or a shared sign-in can leave clipboard contents for the next user.
- Clipboard history services. Windows Clipboard History, macOS universal clipboard, and third-party tools like Ditto or Paste.app persist every copy, often cloud-syncing across devices. A short-lived copy becomes a long-lived record.
What "clearing" actually means
There is no OS-level "clear clipboard" primitive in the strict sense. The clipboard is always in one of two states: holding content, or holding empty content. Clearing means writing an empty value that overwrites whatever was there before. Whether the previous bytes are scrubbed from memory depends on the OS clipboard implementation — most clear the owning handle and let the memory be reclaimed. That is good enough for practical purposes.
Clearing from a web page
Using the async Clipboard API, a web page can write an empty string:
await navigator.clipboard.writeText('');
This replaces the current clipboard contents with an empty string. Subsequent reads from any application will find an empty string under text/plain, and nothing under other text types. If you need to also strip non-text representations, write a ClipboardItem with an empty blob for each type you care about:
await navigator.clipboard.write([
new ClipboardItem({
'text/plain': new Blob([''], { type: 'text/plain' }),
'text/html': new Blob([''], { type: 'text/html' }),
}),
]);
The call requires the page to have focus and typically must be triggered by a user gesture (a button click, a keypress). If the call is rejected with NotAllowedError, the clear did not happen — surface a visible error so the user knows to click the page and try again.
A "Clear Clipboard" button pattern
In Clipboard Inspector, we expose a one-click Clear Clipboard button that behaves like this:
- User clicks "Clear".
- A
clickhandler callsnavigator.clipboard.writeText(''). - On success, the button briefly shows "Cleared" and switches back.
- On rejection, the button shows the error name and suggests pressing Ctrl+V into the page's drop zone to overwrite the clipboard manually.
The manual fallback exists because, in some browsers, writing to the clipboard requires a user gesture within a specific time window that has expired by the time a user clicks a button twice. Offering the user a second, even more explicit way to overwrite the clipboard turns a potential failure into a workable UX.
When should users clear?
Encourage clearing after any copy of:
- Passwords and pass-phrases. Password managers such as 1Password and Bitwarden auto-clear the clipboard after 30–90 seconds by default; verify your users' manager is configured to do so.
- One-time codes and recovery codes. These should never linger.
- API keys, personal-access tokens, and SSH private keys. A leaked token is a breach.
- Credit-card numbers, social-security numbers, and regulated personal data. Compliance frameworks (PCI-DSS, HIPAA) frown on long-lived clipboard contents.
- Corporate confidential snippets. Quotes from internal documents, customer emails, and draft announcements.
Less obviously: encourage clearing before joining a screen-share, before installing a new browser extension, and before handing the device to anyone else. Any of those moments turns "a string sitting in RAM" into "a string somebody else can read".
Clearing from outside the browser
If you cannot run JavaScript on the target system, every OS has a native way to clear:
- Windows: Press
Win+Vto open Clipboard History, then Clear all. - Windows (PowerShell):
Set-Clipboard -Value "". - macOS:
pbcopy < /dev/nullin Terminal. - Linux (X11):
xsel -bc(clears the clipboard selection). - Linux (Wayland):
wl-copy --clear.
Teach these commands in security training. Power users can bind them to global hotkeys.
A note on "paranoia mode"
Some developer tools and password managers offer a "clear clipboard after N seconds" timer. These are convenient but not bulletproof: the timer only fires while the tool is running. If the tool crashes or is killed, the clipboard keeps its payload until something else is copied. A short-lived, scripted clear at the moment of paste (e.g. "on successful sign-in, call navigator.clipboard.writeText('')") is a stronger guarantee because it triggers at a known good moment.
Build clearing into your product
If you ship a developer tool, a password manager, or any feature that exposes sensitive strings, add a prominent "Copy then clear after 30 seconds" option. It costs a handful of lines of code and dramatically reduces real-world leakage. And when you expose a clipboard feature to end users, accompany it with a note on why they might want to clear it afterwards.
Clipboard Inspector's Clear Clipboard action is built exactly for these moments. After pasting to debug a suspicious clipboard payload, a single click wipes it before the investigation moves on.