Security
How the encryption works
Plain language, including the parts that are not flattering. If you only read one paragraph, read the next one.
Your content is encrypted in your browser before it is sent. The key that decrypts it is kept in the part of your link after the #, and browsers never transmit that part to a server. So what arrives here is a block of bytes we have no way to read. Not “bytes we promise not to look at” — bytes we hold no key for.
What happens when you open a clipboard
- 01Your browser generates a random 256-bit AES-GCM key. This happens on your device, before anything is sent anywhere.
- 02Your browser also generates a random 128-bit clipboard id. That id is the address the two devices meet at. It is not a secret, and it is not enough to read anything.
- 03We are told the id and your expiry choice, because we need those to route messages and to delete the clipboard on time. We are not told the key. There is no request in the app that contains it.
- 04Everything you type or send is encrypted with that key, with a fresh random nonce each time, and tagged so it can only be decrypted inside the clipboard it was written for. We relay the result without being able to open it.
Why the part after the # matters
A URL has two halves, and they behave completely differently.
| Part | Contains | Sent to us? |
|---|---|---|
| /r/… | The clipboard id | Yes — we need it to route |
| #k=… | The decryption key | Never |
That second row is not a policy we wrote. Not sending the fragment is how URLs are specified to work: it is left out of the page request, out of background requests, and out of the Referer header your browser sends to other sites. Your browser enforces it, not us.
The practical consequence: if you lose the link, we cannot recover your clipboard. There is nothing on our side to recover it from.
What this does not protect against
Every product in this category claims to be secure. Very few say where the edges are. Here are ours.
Anyone holding the full link can read the clipboard
The link is the credential. If you paste it into a group chat, or it ends up in a screenshot, whoever sees it can open the clipboard until it expires. Use a short expiry, or “destroy after the first read”, for anything sensitive.
We serve the code that does the encrypting
This is the honest limit of all browser-based encryption, ours included. The JavaScript doing the encryption arrives from us on every visit, so a malicious or legally compelled change to it could capture your key. We reduce the surface — the pages load no third-party scripts at all, no analytics, no ads, no fonts or libraries from anyone else’s servers, enforced by a Content Security Policy the browser applies — but we cannot claim to have eliminated it, and neither can anyone else with a web app.
Metadata is visible to us
We can see that a clipboard exists, when it was created, roughly how large its contents are, how many devices connected, and when. We cannot see what any of it says, and file names are encrypted along with file contents.
Your devices are still your responsibility
Encryption in transit and at rest on our side does nothing about a shared computer, a browser history someone else can read, or malware on either device.
Check it yourself
You do not have to take our word for any of this, and you should not have to.
- 01Open a clipboard, then open your browser’s developer tools.
- 02Type something into it and watch the Network tab. Search every request for the key from your address bar. It will not appear in one.
- 03Search the same requests for the text you typed. That will not appear either — only base64 ciphertext.
- 04While you are there: every request should be to this domain and no other. That is the Content Security Policy doing its job.
About the clipboard mirror
The optional mirror can copy across automatically, but only while its tab is open and focused. A web page has no way to watch the clipboard while it is in the background — that needs an installed app, and there is no browser API for it. Anything claiming otherwise in a browser tab is overstating what it does. In Safari and Firefox even the focused case is restricted, so those get the manual “Sync now” button instead.