Is Super Clipboard Manager - Copy Paste History safe?
We analyzed Super Clipboard Manager - Copy Paste History version 3.0.0's actual code and gave it a 72/100 trust score. This is a purpose-aligned clipboard…
Bottom line
This is a purpose-aligned clipboard manager, but its all-site coverage and retention of copied secrets and page addresses warrant caution.
What it can access
It runs in all web and local-file pages and handles copied text, including selected password-field text, while storing page addresses [Q1][Q3][Q15].
Security weaknesses
Copied secrets can remain in local history, and page-wide listeners capture text whenever the user copies it [Q3][Q8].
Signs of misuse
No evidence shows outside transmission, downloaded code, session theft, remote commands, or other misuse beyond its clipboard purpose [Q6][Q7][Q14][Q16].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
Its page access runs in every frame on HTTP, HTTPS and local-file pages. It also requests clipboard read/write, storage, downloads, context menus, activeTab, scripting and offscreen permissions.
Declares clipboardRead/Write, storage, downloads, contextMenus, activeTab, scripting and offscreen. — manifest.json:19-29
Runs content.js at document_start in all frames on web and file URLs. — manifest.json:33-42
Which websites can it run on, and can it read or change what appears on those pages?
It reads only the user's current selection during a copy action or selection fallback. No page scraping, full-page serialization or unrelated page-text collection was found.
Reads clipboardData, the selected slice of the focused text control, or window.getSelection(). — content.js:82-129
Sends captured text only from copy/beforecopy or Ctrl/Cmd+C handling. — content.js:34-79
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Text deliberately copied from an email, password or other text input can be stored. This is expected clipboard-manager behavior, but it means copied secrets remain in local history until removed; the code does not automatically read an unselected password.
Reads the selected value range and treats email/password inputs as supported text controls. — content.js:116-129, 201-225
Stores the copied string in clipboardHistory with timestamp and source URL. — background.js:151-177
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores clipboard history and the page URL where each copy occurred in local extension storage. It does not request Chrome history, cookies, bookmarks or tabs permissions.
Adds or updates local history items with text, timestamp, pinned state, URL and tags. — background.js:151-177
Requests storage but not history, cookies, bookmarks or tabs. — manifest.json:19-29
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can write text to the clipboard and download a user-requested history export. Direct silent clipboard reading, camera, microphone, geolocation, arbitrary file access and installed-application access were not found.
Writes requested text through navigator.clipboard.writeText or a packaged textarea fallback. — offscreen.js:1-45
Creates JSON, CSV or text Blob exports and downloads them only from the export UI. — popup.js:900-963
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Clipboard capture, storage, context-menu and insertion flows remain inside Chrome extension APIs. — background.js:1-418
Fetches language JSON through chrome.runtime.getURL rather than a remote endpoint. — popup.js:78-95
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Uses fixed packaged logic and local storage only. — background.js:1-418
No remote configuration fetch or response-driven action path is present. — popup.js:1-1527
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
After installation it automatically listens for copy events across matching pages. It records only when a copy action occurs, deduplicates rapid duplicate events and honors the user's pause setting.
Registers copy/beforecopy and copy-shortcut listeners, with an 80 ms fallback and 750 ms dedupe window. — content.js:12-79
Rejects new captured items while capturePaused is true. — background.js:54-72
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Does not request proxy, privacy, management or settings-override permissions. — manifest.json:19-29
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable source clearly implements copy capture and insertion. — content.js:1-249
Readable source clearly implements local storage, menus and clipboard writing. — background.js:1-418
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains no dynamic-code primitive. — content.js:1-249
Contains no dynamic-code primitive. — background.js:1-418
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Sends copiedText and pageUrl: window.location.href to the background. — content.js:142-160
Persists the full pageUrl in the local clipboard-history item. — background.js:151-177
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Creates local item IDs with crypto.randomUUID or a time/random fallback. — background.js:386-418
No analytics or telemetry endpoint is present. — popup.js:1-1527
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Does not request cookies or identity permissions. — manifest.json:19-29
Reads only the selected range of a supported input during a copy action. — content.js:116-129, 201-225
Does it record typing, form entries, clipboard contents, or screenshots?
It captures selected text on copy and can write pinned text into the focused input or editable element. It does not record arbitrary keystrokes, screenshots or unselected form contents.
Handles copy events/shortcut and extracts only clipboard or selected text. — content.js:12-129
Inserts an explicitly selected pinned item at the current cursor or writes it to the clipboard. — content.js:163-249
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No remote command, polling or configuration channel exists. — background.js:1-418
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Handles a pinned context-menu click and sends insertPinnedText to that tab/frame. — background.js:75-117, 304-350
Performs the insertion and dispatches an input event. — content.js:163-249
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It creates a local JSON, CSV or text download when the user exports history. No executable download, proxy, traffic redirection or network interception was found.
Builds an export Blob and invokes chrome.downloads.download from the export flow. — popup.js:900-963
Does not request proxy, webRequest or declarativeNetRequest. — manifest.json:19-29
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Does not request nativeMessaging or system-application access. — manifest.json:19-29
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Contains no remote fetch or dynamic execution mechanism. — background.js:1-418
The only fetch loads a packaged locale JSON URL. — popup.js:78-95
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Does not declare externally_connectable. — manifest.json:1-50
Listens only for the internal insertPinnedText runtime action. — content.js:18-32
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Behavior depends only on packaged logic, Chrome events and local storage. — background.js:1-418
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is event-driven clipboard history and context-menu management. — background.js:1-418
Does it change form fields or where a form sends its information?
It can insert pinned text into focused form fields, including password fields, after the user chooses that pinned context-menu item. No code changes form actions, submission URLs or hidden fields automatically.
Inserts caller-supplied pinned text at the current selection in supported input types. — content.js:163-225
Supports text, search, URL, telephone, email and password input types without modifying form destinations. — content.js:201-225