The clipboard is a deliberate hole in app isolation
Operating systems keep applications separated from one another, and the clipboard is an intentional exception — a shared surface designed so content can move between apps.
That is exactly why it deserves attention. The moment you copy something out of a vault, the vault's encryption stops governing it. Clipboard access depends on the OS version, foreground state, permissions, and access path, so treat copied content as outside the vault boundary without assuming every app can read it freely.
Cross-device sync widens the surface
Several ecosystems synchronise the clipboard across devices signed into the same account, so text copied on a phone becomes pasteable on a laptop or tablet.
This is convenient and it means a copied secret may traverse the network and land on devices you were not thinking about. If you do not use the feature, turning it off is a meaningful reduction.
Paste prompts are a signal worth reading
Some current OS versions surface an indicator or prompt when an app reads clipboard contents. The behavior varies by platform, version, and access path, so do not treat a missing prompt as proof that nothing read the clipboard.
Treat an unexpected paste prompt as information about the app requesting it, particularly when you did not intend to paste anything.
Practical handling
- Prefer password-manager autofill over copying credentials manually.
- Review which apps have requested paste access and why.
- Disable cross-device clipboard synchronisation when you do not use it.
- Overwrite sensitive clipboard content with something harmless after use.
- Avoid copying recovery phrases at all — write them down instead.
The two most damaging habits
- Copying a backup recovery phrase into a chat, note, or email to move it around.
- Assuming that closing the source app clears the clipboard; an app can implement cleanup, so verify the behavior rather than relying on either outcome.
A fictional example
Priya starts with a non-sensitive test: “Review apps that request paste access.” Next, Priya follows the second check: “Disable cross-device clipboard features when they are not needed.” This fictional scenario demonstrates the decision process; it is not a report of product testing.
Common mistakes
- Copying backup recovery phrases into chat
- Assuming closing the source app clears the clipboard
What this workflow does not change
- Copying backup recovery phrases into chat
- Assuming closing the source app clears the clipboard
Questions people ask
Can NullVault protect text after I copy it?
No. Once copied, the destination and operating system govern that clipboard content.