For Mac and Windows · local-only

The clipboard manager for developers Encrypted history. Secrets behind Touch ID.

CopyBuffer remembers the text, images and files you copy and brings them back with ⌘⇧V. History is encrypted with a key held by your Mac's Secure Enclave, and API keys come from a Touch ID vault instead of a plain-text .env.

  • No cloud, accounts or tracking
  • 7-day free trial · one-time purchase
  • macOS 14+ · Windows 10/11

What is CopyBuffer?

CopyBuffer is a clipboard manager that lives in the macOS menu bar and the Windows notification area. Every copy is recorded; press ⌘⇧V (or Win+Alt+V on Windows) and a list opens right under your text caret. Type to search, press ↩ to paste.

What sets it apart is that it is built around security and developer workflows: history, snippets and images are encrypted on disk, copies from password managers are never stored, and on a Mac, vault values can be handed to your terminal as environment variables after Touch ID. There is no cloud, so your data stays on your computer.

Type
Clipboard manager for the macOS menu bar and the Windows notification area
Shortcut
⌘⇧V · Windows: Win+Alt+V
Storage
This computer only, AES-256-GCM
Key
Wrapped by the Secure Enclave (Mac) or DPAPI (Windows)
Network
Only when you ask (breach check, license registration)
Requires
macOS 14 Sonoma+ (Apple Silicon) · Windows 10 (2004)+ and 11 (x64)
App language
9 languages, follows your system language
Price
7-day free trial, then US$12.99 one-time · one key for Mac and Windows
Version
macOS 0.2.0 · · Windows 0.1.0

Find what you copied. Paste it in the shape you need.

Keyboard first. Press ⇥ in the panel to switch between the Clipboard, Snippets and Password tabs.

Text, images and files

Search with several words at once. Large images paste as a file path, and files copied in Finder are stored as paths only, to save disk space.

↩ Paste · ⌥↩ As path · ⌘1–⌘9 quick paste

Search inside screenshots

Find that error screenshot later by the words in it. Korean, English, Japanese and Chinese text plus QR codes and barcodes are read on-device with Apple Vision.

Paste transforms

Pretty-print or minify JSON, strip tracking parameters (utm_*, fbclid), sort and dedupe lines, change case, URL and Base64 encode/decode — 15 in total.

⌘T

Paste in sequence

Mark several items, then paste them one by one into different fields, or all at once joined together. The menu bar shows how many are left.

⌘↩ Mark several · ⌃⌘V Paste next item · ⇧↩ All at once

Snippets

Reusable text, found by keyword. Placeholders like {date}, {time} and {clipboard} are filled in when you paste.

Touch ID password vault

Logins for the site you're on come first, with a phishing warning if you paste a password into the wrong site. 2FA codes (TOTP), password audit for weak and reused passwords, breach check and encrypted backups.

↩ Paste password · ⇧↩ Username · ⌥↩ 2FA code

Env vars for your terminal

cbvault run injects vault values into a single command. Every request needs Touch ID and is logged.

Control what gets recorded

Per-app exclusions (password managers by default), pause recording for 15 minutes, 1 hour or until you resume, or skip the next copy. Copies that password managers mark as concealed are never stored.

Stop keeping API keys in plain-text .env files

Tag a vault entry with an environment variable name and pull it into your terminal with Touch ID, only when you need it.

# inject into one command only (safest)
$ cbvault run OPENAI_API_KEY STRIPE_KEY -- npm run dev

# export into the current shell
$ eval "$(cbvault export OPENAI_API_KEY)"

# one line in ~/.zshrc → cbload / cbunload
$ eval "$(cbvault shell-init)"
$ cbload DATABASE_URL
Loaded: DATABASE_URL

Repeat requests for the same names from the same terminal are approved for 5 minutes; locking the vault revokes that immediately.

  • Touch ID approval — shows what is asking for which variables before handing anything over.
  • Code-signature check — only a cbvault signed with the app's own certificate can connect, verified via the kernel audit token. Copied or modified binaries are refused.
  • Same user only — requests arrive over a 0600 Unix socket and the peer's user ID is checked.
  • Access log — the requesting process path, working directory and the decision are recorded in the encrypted log.
  • Nothing to commit — there is no secrets file in your repo to leak.

Where your API keys live

.env fileexport in ~/.zshrccbvault run
On diskPlain textPlain textEncrypted vault
Approval to readNoneNoneTouch ID
Who receives itAnything that reads the fileEvery program started from that shellThe named command and its children
Audit trailNoneNoneWhen, which process, which folder
Accidental exposureCommitted if .gitignore is missedExposed if dotfiles are publishedNo value in any file

More secrets pass through your clipboard than you think

Tokens, customer data, internal URLs, one-time codes. CopyBuffer is designed to minimize what is left on disk and in memory.

  • Encrypted history — clipboard history, snippets and images use AES-256-GCM. The key is wrapped by a Secure Enclave key, so copied files are useless on another Mac.
  • Three-factor vault — master password (PBKDF2-SHA256, 3,000,000 iterations) + this Mac's Secure Enclave + Touch ID. A stolen vault file cannot even be brute-forced elsewhere.
  • Sealed in memory — while the vault is open, each secret stays encrypted under a separate key until the moment you view or paste it.
  • Fewer traces — pasted passwords are replaced by your previous clipboard after 1 second, copied ones are cleared after 20 seconds, and neither travels to your iPhone or iPad through Universal Clipboard. Vault windows are hidden from screenshots and screen sharing, and won't open at all while the screen is being recorded or shared.
  • Tamper-evident, rate-limited — weakening KDF settings or swapping entries makes the file fail to open; failed unlocks back off exponentially after 5 attempts.
  • Hardened process — hardened runtime, core dumps disabled, debugger attach denied.
Everything lives in ~/Library/Application Support/CopyBuffer (readable by you only)
DataProtection
Clipboard historyAES-256-GCM · Secure Enclave–wrapped key
ImagesAES-256-GCM · temporary paste copies deleted after 30 min
SnippetsAES-256-GCM
Password vaultMaster password + Secure Enclave + Touch ID
Access logEncrypted with the vault, cannot be edited

Honestly: while the vault is unlocked its data key is in the app's memory (wiped on lock), and the code has not had an external security audit yet. The vault auto-locks after 5 idle minutes, on sleep and on screen lock.

CopyBuffer for Windows

The same encrypted history, snippets, paste transforms and password vault, in the Windows notification area. One license key works on both Mac and Windows.

MacWindows
Lives inMenu barNotification area
Open the list⌘⇧VWin+Alt+V
Paste as plain text⌥⇧⌘VWin+Ctrl+Alt+V
Selected text to the vault⌃⌘CWin+Alt+C
History keySecure EnclaveDPAPI (your Windows account)
Password vaultMaster password + Secure Enclave + Touch IDMaster password + this Windows account (DPAPI) + Windows Hello
Search inside screenshotsYesNot yet
Paste in sequenceYesNot yet
cbvault terminal commandYesNot yet
RequiresmacOS 14 Sonoma or later, Apple SiliconWindows 10 version 2004 or later, or Windows 11, x64
  • Kept out of Windows clipboard history — everything CopyBuffer puts on the clipboard is marked so it stays out of Win+V history and cloud clipboard sync.
  • Password managers skipped — copies they mark as excluded are never recorded, and KeePass, KeePassXC, 1Password and Bitwarden are excluded by default.
  • Same clean-up — pasted passwords are replaced by your previous clipboard after 1 second, and copied ones are cleared after 20 seconds.
  • Locked and hidden — the vault window and the Password tab are hidden from screen capture, and the vault locks after 5 idle minutes, on screen lock, sign-out and sleep.
  • Your folder only — data lives in %LOCALAPPDATA%\CopyBuffer, readable only by you and SYSTEM.

Good to know: the Windows app is not code-signed yet, so SmartScreen may warn you the first time you run it. Windows Hello is an extra confirmation on top of the master password and DPAPI, not an encryption key.

Is it for you?

A good fit if you

  • copy and paste all day between terminal, editor and browser
  • are uneasy about API keys in .env files or notes
  • need to find that error screenshot, log line or JSON response again
  • want to know exactly what your clipboard app stores and where

Not a fit if you need

  • sync across devices (there is none)
  • shared team vaults
  • browser autofill
  • iPhone or Android apps

Frequently asked questions

What is CopyBuffer?

CopyBuffer is a macOS menu bar clipboard manager built for developers. It records the text, images and files you copy, lets you search and paste them with ⌘⇧V, and stores the history encrypted on your Mac only. It also includes snippets, a Touch ID password vault and a CLI that loads secrets as environment variables. The user guide lists every shortcut.

Is there a Windows version?

Yes. CopyBuffer for Windows lives in the notification area on x64 PCs with Windows 10 (version 2004 or later) and Windows 11, and opens with Win+Alt+V near your text cursor. It has the same encrypted history, snippets, paste transforms and password vault, protected by your master password, your Windows account (DPAPI) and Windows Hello. Search inside screenshots, paste in sequence and the cbvault terminal command are Mac only for now. One license key works on both.

Does macOS have a built-in clipboard history?

Only a short one, and only on recent versions. Up to macOS 15 Sequoia the Mac keeps just the last thing you copied (Finder ▸ Edit ▸ Show Clipboard). macOS Tahoe 26 adds clipboard history to Spotlight, kept only for a limited time. CopyBuffer keeps your last 500 copies plus anything you pin, encrypted on disk and searchable down to the text inside images, on macOS 14 Sonoma and later. See how to see clipboard history on a Mac.

Does CopyBuffer send my clipboard to the internet?

No. There is no cloud, no account and no analytics, and your clipboard never leaves your computer. The app goes online only when you ask it to: the breach check sends the first 5 characters of each password's SHA-1 hash to Have I Been Pwned, and registering a license key sends only that key, once, to our license server.

How is the clipboard history stored?

It is encrypted with AES-256-GCM in ~/Library/Application Support/CopyBuffer. The key is wrapped by a Secure Enclave key on your Mac, so the files cannot be opened if copied to another machine. The folder is readable by you only (0700).

Does it record passwords copied from my password manager?

No. Copies marked as concealed by password managers are skipped, and Keychain Access, Passwords, 1Password, Bitwarden, KeePassXC and Proton Pass are excluded by default. You can exclude any other app, pause recording, or skip the next copy. Passwords you copy from CopyBuffer's own vault stay on this Mac and don't travel to your iPhone or iPad through Universal Clipboard. See how to keep copied passwords out of clipboard history.

How do I load an API key into my terminal?

Give a vault entry an environment variable name, then run cbvault run OPENAI_API_KEY -- npm run dev. The value is passed only to that command after Touch ID approval, and the requesting process and working folder are written to the encrypted access log. There's no need to keep the key in a plain-text .env file. See how to keep API keys out of .env files.

How do I paste without formatting on a Mac?

Many apps have Edit ▸ Paste and Match Style (⌥⇧⌘V), but not all of them. With CopyBuffer, ⌥⇧⌘V pastes the current clipboard as plain text in any app, and anything you paste from the ⌘⇧V list is plain text too. See how to paste without formatting on a Mac.

Can it replace my password manager?

It is not meant to. The vault is for one Mac and is optimized for developer keys and frequently pasted logins. It has no sync, no browser autofill and no team sharing, and it has not had an external security audit yet. For important accounts, keep using your password manager alongside it.

Why does it need Accessibility permission?

To paste the chosen item straight into the app you were using, to open the list under your text caret, and to read the browser's current address so matching logins come first. It asks once, the first time you paste. Without it, CopyBuffer still copies the item to the clipboard, so you can press ⌘V yourself.

Why isn't it on the Mac App Store?

Sandboxed App Store apps cannot read the text caret position or the browser's current address in other apps, or send the paste keystroke. Those are core features, so CopyBuffer is sold directly from this site.

How does search inside screenshots work?

When you copy an image, Apple Vision reads the Korean, English, Japanese and Chinese text and any QR code or barcode in it, on your Mac, and adds them to search. Images are never sent anywhere, and you can turn this off in Settings ▸ General. See how to search text inside screenshots on a Mac.

What does it cost and what does it run on?

Try every feature free for 7 days, then keep it with a one-time US$12.99 purchase. No subscription. Payment is handled by Lemon Squeezy, which emails you a license key. When you register it, the app sends only that key once to our license server; after that the key is checked offline. After the trial, clipboard history keeps recording and your password vault always stays accessible. It runs on Apple Silicon Macs with macOS 14 Sonoma or later, and on x64 PCs with Windows 10 (version 2004 or later) or Windows 11; one key works on both.

Can I move my data to a new Mac?

Export the password vault as a backup file encrypted with a separate password and import it on the new Mac, or open it with the recovery key you got when you created it. Clipboard history is tied to this Mac's Secure Enclave and cannot be moved.

Which languages does CopyBuffer support?

The app is available in English, Korean, Japanese, Simplified Chinese, Traditional Chinese, Spanish, German, French and Hindi, and follows your macOS or Windows language. Text search inside images (Mac) reads Korean, English, Japanese and Chinese.

Get CopyBuffer

Free for 7 days · then US$12.99 one-time · no subscription

Checkout is handled by Lemon Squeezy, which emails you a license key. Paste it in Settings ▸ License: the app checks it once with our license server, then works offline. No account needed.

macOS 14 Sonoma or later · Apple Silicon / Windows 10 (2004) or later, Windows 11 · x64 · Version macOS 0.2.0 · Windows 0.1.0