Is Clipboard History safe?
We analyzed Clipboard History version 3.1.0's actual code and gave it a 76/100 trust score. This is a purpose-aligned clipboard-history extension with…
Bottom line
This is a purpose-aligned clipboard-history extension with broad page access and meaningful privacy exposure from locally retained copied content.
What it can access
It runs across HTTP and HTTPS pages and reads copied text or images for its core feature [Q1][Q2]. It can retain sensitive copied material and source-page details locally [Q3][Q4].
Security weaknesses
Broad page coverage and default ongoing capture can expose sensitive copied material if the browser or extension storage is compromised [Q2][Q3]. It also retains history until limits or expiry are configured [Q3].
Signs of misuse
There is no evidence of sending clipboard data elsewhere, downloading code, or accepting commands from websites [Q6][Q7][Q16]. Its behavior matches the stated clipboard-history purpose [Q1].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has broad page reach plus local storage, clipboard-write and user-triggered scripting capabilities that are consistent with a clipboard-history tool.
Declares storage, unlimitedStorage, clipboardWrite, scripting, activeTab and contextMenus. — manifest.json:10-17
Loads its content script in every HTTP/HTTPS frame, including matching about:blank frames. — manifest.json:49-60
Which websites can it run on, and can it read or change what appears on those pages?
On copy or cut, it reads the selected text and limited copied HTML or image data from the page.
Builds a payload from the current selection, clipboard HTML containing a link/image, and copied image files. — scripts/content.js:4-34
Capture is reached from copy and cut event listeners. — scripts/content.js:46-48
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Copied content can be sensitive, but it is stored locally and the extension supplies meaningful controls; it does not read password-field contents.
Capture is on by default, the default cap is 500 items and automatic retention expiry is disabled. — scripts/background.js:26-27
Users can cap history, enable expiry, pause capture, disable image capture or exclude domains. — scripts/options.js:117-135
Reads selected text from supported fields but explicitly returns an empty string for password inputs. — scripts/content.js:50-69
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores clipboard history in local extension storage and can retain source-page metadata; it does not access cookies or Chrome browsing history.
Persistence uses chrome.storage.local; sync is only read for one-time legacy migration. — scripts/background.js:29-42
Clip metadata includes the source URL and title and is outside the encrypted content envelope. — scripts/background.js:97-98
No cookies, history or browsingData permission is requested. — manifest.json:10-17
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can write selected clips back to the system clipboard and store images that the user copies; it has no camera, microphone or file-system access.
Requests clipboardWrite but no camera, microphone, downloads or file-system permission. — manifest.json:10-17
A popup action writes stored text, HTML or a data-URL image to the clipboard. — scripts/popup.js:295-315
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
History persistence is implemented with Chrome local storage rather than an HTTP client. — scripts/background.js:29-42
Captured content flows from the internal message into local history and savePlain. — scripts/background.js:458-482
The only fetch reads a stored data: image URL locally for clipboard conversion. — scripts/popup.js:310-320
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The worker and content script are packaged files. — manifest.json:46-60
Behavior is selected only by packaged message handlers and locally stored settings. — scripts/background.js:406-434
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically opens a vendor welcome page once after installation, registers an uninstall page and runs an hourly local retention check.
Registers the uninstall URL, opens /successful-installation only for a first install and creates the retention alarm. — scripts/background.js:275-290
The alarm only removes locally stored clips when the user configured retention. — scripts/background.js:292-303
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, browserSettings, privacy, search or management permission. — manifest.json:10-17
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Capture logic is short, named and directly traceable. — scripts/content.js:1-70
Storage and encryption behavior is documented and implemented in readable source. — scripts/background.js:1-221
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses packaged functions and chrome.scripting.executeScript with a packaged function reference, not text-as-code. — scripts/background.js:1-638
Contains no dynamic execution primitive. — scripts/content.js:1-70
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
For a copy/cut message, reads sender.tab URL/title and adds them to the clip before local storage. — scripts/background.js:458-476
The path runs on copy and cut events, not on navigation. — scripts/content.js:46-48
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
A random UUID identifies a local clip and is stored with that clip; it is not transmitted. — scripts/background.js:467-476
The associated data sink is Chrome storage. — scripts/background.js:29-42
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or webRequest permission is declared. — manifest.json:10-17
Password input fields return no selected text. — scripts/content.js:50-58
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Only copy/cut listeners call selection extraction, which rejects password inputs. — scripts/content.js:46-69
No desktopCapture or tabCapture permission is present. — manifest.json:10-17
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable declaration and no remote service configuration. — manifest.json:1-62
The message router accepts internal extension/content-script messages only. — scripts/background.js:406-434
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The paste-recent command injects a packaged function that writes the newest clip to the active input, textarea or contenteditable element. — scripts/background.js:306-337
The editable-field context menu inserts only the clip the user selected. — scripts/background.js:339-400
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy or downloads permission. — manifest.json:10-17
Its only fetch target is an already stored data: URL. — scripts/popup.js:310-320
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is requested. — manifest.json:10-17
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads packaged background and content-script files. — manifest.json:46-60
executeScript receives the packaged insertTextIntoActive function and a text argument; the text is inserted into a field, not executed as code. — scripts/background.js:306-335
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Does not expose external messaging. — manifest.json:1-62
Sends copy/cut content inward but registers no page-controlled message listener. — scripts/content.js:1-70
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Validates and stores the user's local settings. — scripts/background.js:539-560
Exposes history, privacy and PIN-lock controls to the user. — scripts/options.js:117-171
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is limited to storage, encryption, menus and retention. — scripts/background.js:1-638
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Insertion targets only document.activeElement and dispatches an input event after a user command. — scripts/background.js:306-321
Both insertion paths require the extension keyboard command or a selected context-menu item. — scripts/background.js:323-400