A Good Reason To Stop Me From Pasting Passwords

CIAM Weekly

SubscribeSign in

A Good Reason To Stop Me From Pasting Passwords

Dan Moore<br>May 25, 2026

Share

Heya,<br>I shared my previous article about preventing password pasting and someone had a great comment:<br>The hidden problem many password managers gloss over is how unbelievably insecure the Windows copy-n-paste is in Windows for decades.

Thanks gregw2, that’s a great point, but it does seem like the vendors of password manager software have addressed it.<br>From 1password’s docs, which defaults to 90 seconds:<br>For your security, 1Password automatically removes copied passwords from the clipboard.

Other providers also do this to varying degrees:<br>Bitwarden has the option to automatically remove clipboard entries, but it is off by default. Here’s some community discussion on the topic (from 2021).

Keeppass can automatically clear data copied to the clipboard

Passwordsafe has options to clear passwords on minimize or database lock, as well as to prevent passwords from being including in clipboard history.

Lastpass has some support for clearing passwords from the clipboard after a set period of time.

If you are writing a password manager, you can also indicate that data should not be included in the clipboard history:<br>Windows offers the ExcludeClipboardContentFromMonitorProcessing format

MacOS offers a couple of undocumented identifiers, including org.nspasteboard.ConcealedType.

While I’m still frustrated at Zwift for making me log in again (and again), the details I found based on gregw2’s comment made me a bit more sympathetic to their stance.<br>However, another factor in any CIAM system is the protected data and functionality. Whenever you are guarding access, weigh convenience vs risk; this is the threat model. While I haven’t thought too deeply about this, on first glance the risk of someone getting into my exercise app account is pretty low.<br>Either way, take a look at your password manager settings and make sure your clipboard settings are secure.<br>Cheers,<br>Dan

Share

Discussion about this post<br>CommentsRestacks

TopLatestDiscussions

No posts

Ready for more?

Subscribe

© 2026 Dan Moore · Privacy ∙ Terms ∙ Collection notice<br>Start your SubstackGet the app<br>Substack is the home for great culture

This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts