Is Ditto Clipboard Manager Safe to Use?

Yes, Ditto is safe to use if you install it from an official source. It's free, open-source software (GPL-3.0) with public code, signed Windows binaries, and no account, cloud or telemetry. Two defaults are worth changing, though: Ditto keeps every clip in an unencrypted database on your PC, and the regular installed version accepts clips sent over the local network unless you tick Disable Receiving Clips under Options > Friends.

Why Ditto is considered trustworthy

• Open source. The full source is on GitHub under GPL-3.0, so anyone can check what it does with your copies. Open-source or closed clipboard apps explains what that does and doesn't guarantee.
• Signed releases. Ditto's README says its Windows binaries are code-signed through SignPath, with a certificate issued by the SignPath Foundation.
• Local-first. The README and website list "No login", "No cloud" and "No telemetry", and Ditto's privacy policy says it collects nothing.
• Maintained. The project's code is still being updated, and the latest release at the time of writing is 3.25.113.0.

None of that means a clipboard manager is risk-free. Any clipboard history is a copy of everything you've copied, so what matters is where it's stored and who else can reach it.

Download Ditto only from these sources

Avoid download portals and sites that repackage installers. A tampered clipboard manager would see everything you copy, and clipboard-stealing malware is a known problem on Windows. Before running a downloaded installer, right-click it, select Properties and check the Digital Signatures tab. Ditto Store vs GitHub compares the install routes.

Where Ditto stores your clips

Ditto's privacy policy gives the locations:

The database is a regular SQLite file (named Ditto.db by default) and Ditto doesn't encrypt it. Other Windows accounts on the PC are kept out by normal profile permissions, but any program running under your account, or anyone with your unlocked session or your unencrypted drive, can read every clip in it. Turn on BitLocker or Device Encryption, and keep the history short (see below). Does a local clipboard app need encryption at rest? weighs how much that matters.

The network feature: Friends

Ditto's Friends feature sends clips between computers running Ditto on your network. It's the only network feature, and it's where Ditto's defaults deserve a look. From Ditto's source code and its Friends options:

• In the installed version, receiving is on by default: Ditto listens on TCP port 23443 on all network interfaces. In the portable and Microsoft Store versions, receiving is off by default.
• Clips are encrypted in transit with a shared Network Password. If you've never changed it, it's a default value that anyone can find in Ditto's public source code.
• A clip received from a computer on your Friends list is put on your clipboard. A clip from any other computer that knows the password is added to your saved clips.

Ditto's own privacy policy describes the port as used for sending clips to machines you define, and says you can turn receiving off. Windows Defender Firewall may also block incoming connections, but don't rely on it.

Turn Friends off if you don't use it

1. Right-click Ditto's tray icon and select Options.
2. Open the Friends tab.
3. Tick Disable Receiving Clips and select OK.

If you do use Friends, set your own Network Password on every PC in the group, and list only your own computers. How to audit whether a clipboard app talks to the network shows how to confirm what's listening.

Does Ditto save passwords from password managers?

Not when the password manager marks its copies. Ditto's source checks for the standard Windows formats that apps use to keep data out of clipboard history and monitors: Clipboard Viewer Ignore, ExcludeClipboardContentFromMonitorProcessing, and CanIncludeInClipboardHistory set to 0. This check is on by default. What ExcludeClipboardContentFromMonitorProcessing means explains these formats.

A password you reveal and copy by hand, or one from an app that doesn't set these formats, will be saved like any other text. For those, use Ditto's own exclusions.

How to lock Ditto down

1. Disable receiving under Options > Friends, as above.
2. Exclude sensitive apps. On the General tab, under Accepted Copy Applications (separate by ;), add process names such as KeePass.exe to Exclude. Copies made in those apps aren't saved.
3. Exclude patterns. On the General tab, select Advanced and use Exclude clips by Regular Expressions to skip text that matches a pattern, optionally only from a given process.
4. Expire old clips. On the General tab, set Paste Entries Expire after a number of days and a Maximum Number of Saved Copies. Ditto deletes expired clips in the background after the PC has been idle for a while. Clips marked Never Auto Delete, in a group, with a hotkey or sticky are kept.
5. Pause before sensitive work. Select Connect To Clipboard in Ditto's tray menu so it's unchecked, and Ditto stops saving copies. Select it again afterwards.
6. Delete what slipped through. Delete individual clips from the Ditto window, or use Delete Clip Data in the tray menu.
7. Encrypt the drive with BitLocker or Device Encryption, since the database itself isn't encrypted.

How to stop clipboard managers from saving secrets covers the same steps for other tools.

What Ditto doesn't protect against

• Malware in your session. Any program running as you can read the live clipboard and Ditto's database. No clipboard manager can prevent that.
• Someone at your unlocked PC. They can open Ditto and search your history. Lock the screen with Win+L.
• Copies made before you excluded an app. Exclusions apply from the moment you add them; delete earlier clips yourself.

How Ditto compares on privacy

Windows clipboard history (Win+V) keeps only 25 items and clears unpinned ones on restart, but it can sync text to other devices if you turn that on. Edge Drop, the screen-edge clipboard shelf made by the team behind this site, has no network listener, honours the same Windows exclusion formats, and encrypts its history index with Windows DPAPI, although its images and long-text files are plain files. Is Edge Drop safe? covers it in the same detail. All three are reasonable choices once you know their defaults.

FAQ

Is Ditto malware?

No. Ditto from its official sources is open-source software with signed binaries. Fake or repackaged downloads are the risk, so install only from the sources in the table above.

Does Ditto send my clipboard to the internet?

Ditto has no cloud sync, account or telemetry. Its only network feature, Friends, sends clips directly between computers on your network, and you can turn receiving off.

Is the Microsoft Store version of Ditto safer?

It's the same program from the same developer. One difference: receiving clips over the network is off by default in the Store and portable versions, while the installed version has it on until you disable it.

Related reading

• Ditto Store vs GitHub: Which Should You Install?
• Ditto Clipboard Manager Review: When It's the Right Pick
• Clipboard Manager Privacy Settings: A Checklist
• What Is Clipboard Hijacking and How Do You Stop It?

Sources

• sabrogden/Ditto (GitHub) — GPL-3.0 licence, install options, SignPath code signing, "No login, No cloud, No telemetry".
• Ditto releases (GitHub) — release 3.25.113.0.
• Ditto website — download options and local-first statement.
• Ditto privacy policy (GitHub wiki) — no data collection, storage locations, Friends port and Disable Receiving Clips.
• Ditto Clipboard (Microsoft Store) — official Store listing.
• Options.cpp (Ditto source) — receive defaults per version, port 23443, default network password, ignore-format enforcement on by default.
• Server.cpp (Ditto source) — listening on all interfaces by default.
• Clip.cpp (Ditto source) — skipping Clipboard Viewer Ignore, ExcludeClipboardContentFromMonitorProcessing and CanIncludeInClipboardHistory.
• CP_Main.rc (Ditto source) — Friends, General and tray menu option names.
• CppSQLite3.cpp (Ditto source) — database encryption call left disabled.
• Excluding clip from saving (Ditto wiki) — regular-expression exclusions.
• Auto Delete (Ditto wiki) — expiry settings and exceptions.
• Clipboard Formats (Microsoft Learn) — the exclusion formats apps use to keep data out of history and monitors.

Copy. Stack. Drop.

Transform your clipboard into an interactive edge shelf. Stack, pin, and drag assets into any app with zero friction.

Download for Windows Get from Microsoft Store

How to Install Guide · First 10 Minutes Guide · Drag & Drop Guide · Edge Drop vs Win+V · Support