Keep secrets out of your clipboard history

You copy an API key to paste it into a dashboard once. A clipboard manager keeps it for weeks, and so does every other app that reads your clipboard. On Hand treats it differently.

How it works: when you copy something that looks like a secret, On Hand checks it on your Mac, doesn’t save it, marks the clipboard as concealed so other clipboard managers can skip it too, and clears it from your clipboard after 90 seconds. The menu bar icon shows a raised hand and tells you what it found, like “Didn’t save this GitHub token.”

What On Hand recognizes

More than 25 kinds of keys and tokens, including:

GitHub and GitLab tokens
Stripe secret keys and webhook secrets
AWS access keys
OpenAI and Anthropic API keys
Google API keys and OAuth client secrets
Slack tokens
npm and PyPI tokens
Hugging Face tokens
SendGrid and Mailgun API keys
Shopify, DigitalOcean, Supabase, and Doppler tokens
Linear, Notion, and Postman API keys
Private keys, like SSH and TLS keys

It also recognizes:

Database URLs that include a password, like postgresql://user:password@host/db, for Postgres, MySQL, MongoDB, Redis, and RabbitMQ.
.env lines that set a secret, like API_SECRET=… or export DATABASE_PASSWORD=…. Lines that point to another variable, like API_KEY=$OTHER_KEY, aren’t flagged.
Card numbers that pass the card checksum, and US Social Security numbers.

Each check looks for a key’s fixed prefix or structure, not a guess about random-looking text, so ordinary copies like UUIDs, hashes, and order numbers are kept as usual.

Hidden from your other clipboard apps

Password managers mark what they copy as concealed, and clipboard managers that follow the nspasteboard.org convention skip those items. When On Hand finds a secret you copied as text, it adds the same mark within a quarter of a second. The text you paste is unchanged.

Whether another app skips it depends on that app honoring the mark and on On Hand getting there before the app reads your clipboard, so treat it as a second layer, not a guarantee.

Cleared after 90 seconds

Skipping history isn’t the whole story: a key also sits on the system clipboard until you copy something else, where any app can read it. If a secret is still on your clipboard 90 seconds after you copied it, On Hand clears it. Copy something else first and nothing changes. If you paste the same key over and over, turn this off in Settings › Privacy.

Screenshots too

On Hand reads the text in images you copy so you can search your screenshots. If that text contains a secret, the screenshot is deleted from history as soon as it’s read, unless it’s pinned.

Questions

Does any of this leave my Mac?

No. Every check runs on your Mac, and On Hand has no account, sync, or analytics. Read the privacy policy.

Will it catch every secret?

No. It catches the formats above. Passwords you type yourself, addresses, and keys without a recognizable format can still be saved. Pause capture from the menu bar before copying something private, or press ⌃ ⌥ ⌘ ⌫ to forget your last copy.

Can I keep a key in On Hand on purpose?

Turn off Don’t save card numbers, Social Security numbers, or secret keys in Settings › Privacy. For keys you reuse, a password manager is still the better home.

Which version do I need?

On Hand 1.5.1 or later, on macOS 14 or later. Installed copies update themselves.