How to Stop Clipboard Managers From Saving Secrets

A clipboard manager that “just works” will store a password the first day it is installed. The fix is a checklist, not a different brand. Windows history, Ditto, CopyQ, ClipboardFusion, and any shelf all need the same policy: do not copy secrets if autofill exists; if a copy happens, do not record it; if it was recorded, expire it.

Secrets are not only login passwords. One-time codes, recovery keys, API tokens, connection strings, and seed phrases are also text. Microsoft’s history stores text, HTML, and bitmap. A 4 MB screenshot of a vault window is a history item even if no one pressed Copy on the password field.

0. Decide whether history is needed

If the PC is used mainly to paste passwords, leave Clipboard history off. Microsoft’s list is text. A password is text. Should You Enable History If You Only Copy Passwords?.

If history is needed for URLs and snippets, keep it on, keep Clipboard history across your devices Off, and continue the list below. Cloud sync is a second recorder. A secret that never appears in Ditto can still land on another signed-in PC. How to Disable Windows Clipboard Cloud Sync.

If this machine copies customer identifiers, production tokens, or health data weekly or more, treat history as a regulated buffer and keep it short — or off.

1. Stop putting secrets on the clipboard

• Use the password manager’s autofill, Universal Autofill, or Auto-Type.
• Do not highlight a revealed password in the page and press Ctrl+C.
• Do not paste production credentials into chat “so a teammate can copy them.”
• Prefer 1Password’s Type in window on Windows when the destination has no integration. That types characters; it does not rely on a long-lived clipboard card.

This step removes the problem from every monitor at once. Is Copying a Password Ever a Good Idea?.

KeePass and KeePassXC document Auto-Type as the alternative to copying into the system clipboard. Bitwarden’s official FAQ still answers “Can I prevent my credentials from being saved to the clipboard?” with a Clear clipboard timer — useful, but second-best to never placing the secret there.

If a site blocks paste, use the vault’s documented fill path instead of lengthening a timer. Why Paste Fails in Password Fields.

2. Confirm the vault sets Microsoft’s exclusion formats

When the official Copy password button is used, the client should set one or more of:

• ExcludeClipboardContentFromMonitorProcessing
• CanIncludeInClipboardHistory = 0
• CanUploadToCloudClipboard = 0
• Clipboard Viewer Ignore

Microsoft documents the first three on the Learn page Clipboard Formats, under Cloud Clipboard and Clipboard History Formats. ExcludeClipboardContentFromMonitorProcessing keeps the item out of history and out of device sync. CanIncludeInClipboardHistory = 0 blocks history only. CanUploadToCloudClipboard = 0 blocks sync only. Well-behaved monitors honor these; malware does not.

CopyQ’s security page lists the same Windows formats plus Clipboard Viewer Ignore, and ignores those copies by default. KeePass 2.x can set Use Clipboard Viewer Ignore clipboard format under Tools > Options > Security.

Test: copy a dummy password with the vault’s official copy control, press Win+V. If the string appears, that copy path is ordinary text. File a bug with the vault vendor and stop using that button.

Reveal-then-select-all-then-Ctrl+C almost never sets exclusion formats. Treat that path as ordinary text.

3. Windows clipboard history

1. Settings > System > Clipboard.
2. History On only if used.
3. Devices / automatic text sync Off.
4. Never Pin a secret. Pins survive Clear and restart.
5. After a sensitive paste: Win+V > … > Delete, or Clear all if the rest of the list can go.
6. Remember the 4 MB / 25 item / restart rules. Unpinned residue dies at reboot; do not rely on that instead of delete.

wipe the Win+V list.

There is no official one-hour timer on this page. Auto-Delete Timers for Clipboard History covers what third-party tools add.

4. CopyQ

Official security docs:

• Secret formats are ignored by default.
• Window-title filters can omit the vault even when formats are missing (FAQ: omit storing text from specific windows such as a password manager).
• Do not assign onSecretClipboardChanged to the normal store function unless the goal is to log passwords.
• Enable tab encryption if sensitive snippets must exist at all.
• Confirm a suspected secret with File > Show Clipboard Content (default Ctrl+Shift+C). If the exclusion formats are present, CopyQ should treat the item as secret.

CopyQ states it does not send data over the network. Still useful, still a local file. Storage is unencrypted unless encryption is turned on. Does a Local Clipboard App Need Encryption at Rest?.

If CopyQ ignores private-browser copies that should be stored, the documented safer override is a script that allows secrets only from matching window titles — not “store all secrets.”

5. Ditto

Ditto stores whatever the clipboard holds unless Options say otherwise.

Typical hardening (labels move slightly by version):

• Exclude the password-manager process or window title. KeePass’s own FAQ names Ditto’s Options > General > Accepted Copy Applications exclude field and the example KeePass.exe.
• Cap the number of saved items so a missed secret ages out.
• Do not enable network/friends features on a laptop that holds client data.
• After install, copy a dummy password and search Ditto. If it hits, the exclude rule failed.

Recent Ditto releases have also added support for not saving clips because of Microsoft’s exclusion formats. Do not assume an old portable build has that. Retest after upgrades.

Ditto is excellent history. It is a poor vault. Ditto vs Windows Clipboard History.

6. ClipboardFusion

The official Free vs Pro chart includes Ignore Specified Applications on the free tier. Add the vault executable there before the first real copy.

Do not enable Pro clipboard syncing on an account that ever copies credentials. Pause ClipboardFusion (the compare page lists a Pause/Resume hotkey) during break-glass password work.

Pro timer triggers can clear the live clipboard. They do not replace an ignore list.

7. PhraseExpress cache

PhraseExpress can restrict its clipboard cache to specific programs. Disable Features > Clipboard Cache entirely if PhraseExpress is only an expander. PhraseExpress vs Ditto.

KeePass’s FAQ notes that PhraseExpress can intercept Tab and Enter and break Auto-Type. If both tools are installed, keep PhraseExpress out of the login path and out of the clipboard cache for the vault window.

8. Incognito / pause

A good monitor offers a pause that:

• Stops recording immediately.
• Does not flush ignored copies into history when pause ends.
• Is obvious (tray icon or badge) so it does not stay off for a week.

Incognito Mode for Clipboard History: What Good Looks Like.

Edge-Drop documents an incognito-style pause and secret-format skips. Treat those as helpers, not a vault. If the shelf is only for images and files, that already reduces text-secret risk.

Pause is a backup control. Always-on exclusion formats and window ignore should still be on. People forget a hotkey at the worst moment — the password reset they meant to hide.

9. Auto-delete timers

Set retention to hours or a day, not “forever.” Pins or a snippet library can keep the few strings that should survive.

Windows itself does not offer a 1-hour timer. It offers restart wipe for unpinned items and a 25-item cap. Laptops that sleep for a week do not get a restart wipe.

Vault timers clear the live clipboard, not Win+V. Configure both layers. Clear the Clipboard Automatically After a Password Paste.

10. One recorder

Two managers plus Win+V means three places to miss an exclude rule. Pick one. Turn the others off.

Do not drop portable Ditto in Downloads because IT disabled Win+V. That is a longer, less auditable log. Enterprise Controls for Windows Clipboard History.

What counts as a secret

What Sensitive Formats Should Monitors Ignore?.

Quick verification table

Does Clipboard History Record Incognito Browser Copies?.

Order of operations on a new PC

Do this before the first real login of the day:

1. Install the password manager. Turn on autofill and the clear timer.
2. Decide whether Win+V is needed. If yes, enable history, disable sync.
3. Install at most one third-party recorder. Configure ignore lists.
4. Run the dummy-password test.
5. Only then sign into work or banks.

Reversing steps 4 and 5 is how the first password of the day becomes item 1 in a fresh Ditto database.

After a vault or manager update, repeat the dummy test. Clients change defaults. CopyQ scripts can be overwritten. Ditto exclude lists can be empty on a new profile.

If a secret is already in history

1. Delete the card (Win+V … > Delete, or the manager’s delete).
2. Clear all if the list is small. Unpin first; pins survive Clear.
3. If sync was on, repeat on every device and Settings > System > Clipboard > Clear clipboard data.
4. Change the password from autofill on a trusted device.
5. Fix the ignore rule that failed, then retest with a dummy.

Deleting without rotating is incomplete if the PC or account may have been shared.

Search the third-party database for fragments (AKIA, ghp_, sk-, BEGIN OPENSSH) if tokens are in scope. A 25-item Win+V list is easy to scan by eye. A 50,000-item Ditto file is not.

Shared desks and pair sessions

Win+V is visible to anyone watching the session. Clear all before a screen-share, or leave history off that day. Pair Programming: Do Not Leave Secrets in History.

On a family PC, separate Windows profiles beat a clever ignore list. The next user who stays in the same sign-in can open history. Clipboard History on a Shared Family PC.

Related reading

• Clipboard Hijacking: What It Is and How to Reduce Risk
• Clear the Clipboard Automatically After a Password Paste
• Does Windows Clipboard Sync Upload What You Copy?
• Why You Cannot Drag Old Clipboard Files Into Explorer

Sources

• Clipboard formats (Microsoft Learn) — exclusion formats monitors must honor.
• Using the clipboard (Microsoft Support) — Win+V pin/clear/sync behavior.
• CopyQ security — default ignore of Windows secret formats and window-title FAQ.
• ClipboardFusion compare — ignore-application feature on the free tier.
• PhraseExpress clipboard manager — program restriction and disable path.
• Bitwarden Password Manager FAQs — official Clear clipboard locations; default Never unless changed.
• KeePass Additional FAQ — clipboard options — own-content clear; Ditto exclude example; Clipboard Viewer Ignore option.
• Copy and fill passwords (1Password Support) — Windows Type in window; 90-second clipboard removal.

Copy. Stack. Drop.

Transform your clipboard into an interactive edge shelf. Stack, pin, and drag assets into any app with zero friction.

Download for Windows Get from Microsoft Store

How to Install Guide · First 10 Minutes Guide · Drag & Drop Guide · Edge-Drop vs Win+V · Support