Why Websites Can't Read Your Clipboard in the Background
Browsers block silent clipboard access to protect you. Here is what the rules are and why they exist.
Browsers stop websites from reading your clipboard silently because it often holds sensitive data such as passwords or messages. Reading requires an explicit permission prompt or paste confirmation, works only on HTTPS pages, and generally only while the page is focused. Writing usually requires a click or keypress from you.
The rules in plain English
- Secure pages only. The modern asynchronous Clipboard API is limited to secure contexts, which in practice means HTTPS (MDN: secure contexts).
- Focus matters. Clipboard calls generally fail when the page is not the active, focused document.
- Reading needs your consent. Depending on the browser this is a permission prompt or a small "Paste" confirmation.
- Writing needs an action. Most browsers only let a page write to the clipboard in response to a click, tap or key press.
- Copy events stay in the page. A page only sees copy and paste events that happen inside it (W3C Clipboard API and events).
Why these limits are good
Your clipboard regularly contains passwords from a password manager, one-time codes and private messages. If any open tab could read it silently, every advertisement and script could harvest that data.
What this means for clipboard tools
A web-based clipboard can only sync what you copy inside it, and needs a click on the receiving device to write to the clipboard. Any website that claims to sync "everything you copy" without installed software is overstating what browsers allow.
Further reading
Want to try it? Open the online clipboard or create a free account to sync between your devices.