Is Edge Drop Safe? Store Build, GitHub, and Local-Only Claims

Is Edge Drop safe? Safe enough for everyday text, links, screenshots, and files on a machine you already trust — if you install the real app and treat it like every other clipboard monitor. It is not a password manager. It is not a guarantee that nothing on the PC can read what you copy. No honest clipboard tool can promise that.

This page is a safety checklist for edgedrop.app: publisher, Store vs GitHub, local-only claims, and what you should still do yourself. It is not a pentest report.

First, confirm which product you mean. Microsoft’s Edge Drop sharing pane in the browser was retired in Edge 152 (Stable 152.0.4191.53, 27 August 2026). That feature used a Microsoft account and OneDrive. This article is about the independent Apache-2.0 clipboard shelf by Deepender Yadav (hover or Alt+C, OLE drag-out, Store 9P3JMHN9M4NR, GitHub Deepender25/Edge-Drop). See Is Edge Drop a Microsoft App?.

Is Edge Drop safe? Work this checklist top to bottom

Print this or keep it next to the installer.

If you only remember one row: publisher identity. Clipboard tools read everything you copy. A lookalike installer is the actual disaster, not the existence of an open-source shelf.

What “local-only” should mean here

Marketing uses “local-first” as a mood. The useful contract is in What Does Local-First Mean for Clipboard Apps?.

For this product, the documented claims are:

• No account to use the shelf
• No cloud clipboard of your history
• No telemetry of copies claimed in the public product facts
• History lives under the user profile, with large text offloaded to disk payloads
• Hover shelf on Windows 10/11 only — not a phone app, not a browser extension

That is a default data path, not an absolute security guarantee.

Honest caveats:

• GitHub builds use electron-updater and talk to GitHub Releases so you can restart into a new version. That is network use. It is not “uploading your clipboard,” but it is not airplane-mode-by-design either.
• Store builds are packaged as MSIX. Updates come from the Microsoft Store’s own update pipeline, not the in-app GitHub updater (isStoreBuild() in the project). The Store is a Microsoft service. Packaging is not Microsoft authorship.
• URL cards in current docs describe *offline* parsing of titles/domains/favicons, not a third-party unfurl API. If a future build fetches the live web to preview a link, that would be a different claim — read the changelog for the version you run.
• Windows itself can still sync text if you enabled clipboard history across devices. The shelf does not turn that Microsoft toggle off for you. Win+V still holds 25 items, 4 MB, text/HTML/bitmap, unpinned wipe on restart.

Verify, don’t slogan. How to audit whether a clipboard app talks to the network is the method: Resource Monitor / a firewall log while you copy a unique string. You should not see that string leave the machine.

Store build vs GitHub build (safety, not features)

Both channels compile from the same public repo. The safety difference is who delivers the bits and how they update.

Neither channel makes copies “unreadable to malware running as you.” If you are already in the user session, the live clipboard is readable. History on disk is extra residue. DPAPI encrypts items.json with keys available to that Windows user — good against a copied file on a dead disk if the user is logged off and BitLocker is on; weak against anything already running as you.

Pick a channel in GitHub installer or Microsoft Store. The longer packaging primer is GitHub installer vs Microsoft Store: which build. Data folder notes: where Edge Drop stores data on disk. Clean removal: how to uninstall Edge Drop cleanly.

What a clipboard shelf cannot protect you from

Same rules as Is Windows Clipboard History Safe?:

• The live clipboard still holds the last copy. Any app in the session can read it, shelf or not.
• Shoulder surfing and shared family accounts see whatever is on screen when the shelf opens.
• Elevated vs unelevated windows: Windows integrity rules still apply. Drag/paste into a higher-integrity window can fail; that is UAC, not a bug to “fix” by running the shelf as admin.
• Pinning a secret keeps it around. Pins are for boilerplate, not one-time tokens.
• Electron RAM (project notes ~130–160 MB) is a resource cost, not a privacy feature.

Documented mitigations in the app: skip concealed password-manager formats (1Password, Bitwarden, KeePass and Windows exclude flags), incognito pause, auto-delete windows, clear unpinned on restart. Use them. They reduce residue. They do not make copying a password a good idea. More: what Edge Drop does with password-manager copies.

A reasonable setup on a personal PC:

1. Install from https://www.edgedrop.app (Store or GitHub). Confirm publisher.
2. Leave Windows Clipboard history across your devices off unless you truly want Microsoft text sync.
3. Turn on auto-delete or clear-unpinned-on-restart if the PC is shared.
4. Do not pin one-time codes.
5. Keep one history owner. If you use the shelf, do not also run Ditto as a second logger “just in case.”
6. Before selling the PC, uninstall and delete the profile data folder. Reboot. Confirm Win+V is clear too.

Work laptops are a different conversation: IT may block unsigned installers, Store-only allowlists, or clipboard entirely. Follow policy. A local shelf is still local *to that managed disk*.

When Edge Drop fits / does not

The shelf fits a safety conversation when you already trust the Windows user account, you verified Deepender25 / 9P3JMHN9M4NR, you will keep secrets out of history, and you prefer open source plus a local data path over a cloud clipboard.

Do not use Edge Drop if:

• You needed a password vault. Use Bitwarden, 1Password, or KeePass — and do not copy vault secrets into any history.
• You needed Microsoft’s retired OneDrive Drop on a phone.
• You cannot (or will not) confirm the publisher.
• Policy forbids third-party clipboard monitors.
• You wanted “nothing on disk ever” — Win+V’s unpinned reboot wipe, or no history at all, is closer.
• You planned to run two watchers plus optional Microsoft text sync.

If the checklist matches the machine you have, the downloads are on https://www.edgedrop.app. If you needed Microsoft’s old phone-PC Drop, this app is the wrong category — use LocalSend or Phone Link instead.

FAQ

Does Edge Drop upload what I copy? The product claims no cloud clipboard, no account, and no telemetry of copies. GitHub builds still check GitHub for updates. Confirm with a network audit if that sentence is the reason you install it.

Is the Microsoft Store listing a Microsoft product? No. The Store hosts third-party apps. Microsoft signs packages for delivery. Publisher is Deepender Yadav.

Is DPAPI the same as a password vault? No. It encrypts data at rest for the Windows user. An unlocked session is decryptable by that user and anything running as them.

Is Edge Drop safer than Win+V? Different residue, not a medal. Win+V clears unpinned items on restart and caps history at 25 text/HTML/bitmap items. The shelf can persist files and images on disk unless you enable wipe options. Persistence is a privacy choice, not automatically safer.

Related reading

• Is Windows Clipboard History Safe?
• What Does Local-First Mean for Clipboard Apps?
• Is Edge Drop a Microsoft App?
• Edge Drop: GitHub Installer or Microsoft Store — Which Should You Get?

Sources

• Edge-Drop GitHub — Security section — DPAPI safeStorage, process isolation, privacy clipboard flags
• Electron safeStorage — DPAPI on Windows
• Using the clipboard (Microsoft Support) — Win+V vs optional cloud text sync
• Microsoft Store listing 9P3JMHN9M4NR — publisher and package identity
• Microsoft Edge 152 Stable notes — retired browser Drop is a different product

Copy. Stack. Drop.

Transform your clipboard into an interactive edge shelf. Stack, pin, and drag assets into any app with zero friction.

Download for Windows Get from Microsoft Store

How to Install Guide · First 10 Minutes Guide · Drag & Drop Guide · Edge-Drop vs Win+V · Support