Keep secrets out of your clipboard history

A clipboard manager remembers what you copy. That is the point, and it is also the risk. Over a working day the clipboard carries API keys, access tokens, passwords from a password manager, and the occasional one-time code. A history that keeps all of it forever is a list you would not want on screen during a call.

DeskAcross has four controls for this. They work at different stages: before an item is saved, when it is displayed, per application, and before it leaves the computer. All four are included on every plan, including Free.

1. Decide whether secrets are saved at all

Open Capture → Privacy in settings.

Save Sensitive Content controls whether high-confidence matches for keys, tokens, and similar secrets are saved to history. Turn it off and DeskAcross skips those matches. The item still reaches the system clipboard, so the paste you were about to do works. It simply is not kept afterwards.

This is the strictest option. It suits you if you never need to paste the same secret twice from history.

Detection looks for content that resembles a secret with high confidence. No detector catches everything, and an unusual password that looks like an ordinary word may pass through. Treat this as a strong default, and use the app exclusions below for the sources you know are sensitive.

2. Mask secrets you do keep

Sometimes you do want the key in history, for example while configuring several services in a row. In that case leave Save Sensitive Content on and turn on Redacted Display.

Redacted Display masks the middle of a saved sensitive entry with asterisks and leaves the first and last characters visible. You can still tell two keys apart in the list, and someone glancing at your screen cannot read either one.

The entry itself remains saved in history. Redaction changes what is shown, not what is stored. If you need the value gone, delete the item or rely on retention rules under History → Retention & Cleanup.

3. Exclude whole applications

Detection works on content. App filters work on the source, which is often the more reliable signal. Anything copied from a password manager is sensitive by definition.

1. Open Capture → App Filters.
2. In Available Apps, search for the app you want to exclude.
3. Select its checkbox, then select the right arrow between the lists.
4. Confirm the app now appears in Ignored Apps.

If the app is missing from the list, use the refresh icon next to Available Apps.

Good candidates to exclude:

• Password managers.
• Banking and finance apps.
• Remote desktop clients, where the clipboard may carry content from a machine you do not control.
• Any internal tool that displays customer data.

4. Keep secrets on the computer they were copied on

Sync adds a second question. An item that is fine to keep on your own computer may not be something you want on every device.

Open Sync → What Syncs and turn off Include Sensitive Items. Items detected as passwords, keys, or tokens then stay on the computer where you copied them. Everything else syncs as usual.

Two more details apply to sync:

• Synced data is encrypted with the Sync Passphrase you set on each computer.
• With Notify When Items Arrive on, sensitive items are left out of notification previews.

Sync runs over your local network or through a folder in your own Dropbox, iCloud Drive, or OneDrive. The second option means encrypted items pass through that cloud provider's storage, which is one more reason to consider keeping sensitive items out of sync.

How the settings combine

The middle row is a reasonable starting point for most people who work with credentials regularly.

For teams

On the pricing page, the Business plan lists centralized policies for cloud sync, sensitive data filtering, and locked app exclusions, marked New. The aim is for an administrator to set these rules once for a team so they do not depend on each person's own settings. If that matters for your organization, contact us and tell us what you need to enforce.

A short checklist

1. Add your password manager to Ignored Apps.
2. Turn on Redacted Display.
3. Decide whether you need Save Sensitive Content at all. If not, turn it off.
4. Turn off Include Sensitive Items under Sync → What Syncs unless you have a reason to sync secrets.
5. Set a Retention Period so old items leave history on their own. Favorites and pinned items are kept, so do not favorite a secret.

If an item you expected is missing from history afterwards, the cause is usually one of these settings doing its job. Configure Clipboard Capture has the full list of checks, and Sync Your Clipboard Across Devices covers the sync side.