---
title: Can Websites Read Your Clipboard? | Relic
description: Websites can read your clipboard through the Clipboard API, but only under strict browser rules. Exactly what a page can see, and how to keep pastes private.
canonical: https://relic.space/blog/can-websites-read-your-clipboard
source: https://relic.space/llms.txt
---
[Clipboard security & privacy](https://relic.space/blog/topics/clipboard-security)

# Can websites read your clipboard?

A web page can touch your clipboard, but only under rules the browser enforces, and the rules are stricter than the scary headlines suggest. This piece covers exactly when a site can read what you copied, when it cannot, and the one gap that deserves more of your attention than the API does.

[JGJordan Gibbs](https://relic.space/authors/jordan-gibbs) June 29, 2026 8 min readUpdated September 12, 2026

It is a fair worry: you copy a password or a bank detail, then open a website, and you wonder whether that page just read what is on your clipboard. The answer is reassuring in the ways that matter and more interesting in the ways that do not. Browsers expose a [clipboard API](https://developer.mozilla.org/en-US/docs/Web/API/Clipboard%5FAPI) to web pages, but they wrap it in guardrails specifically so a random site cannot reach into shared memory and slurp up whatever you last copied. The bigger everyday risk turns out to be something quieter, and we will get to it.

This piece zooms in on the browser. For the wider picture of what software on your machine can see, start with the overview, [is your clipboard a security risk?](https://relic.space/blog/is-your-clipboard-a-security-risk)

## Can a website see what you copied?

Only if you let it. A page reads the clipboard with [**navigator.clipboard.readText()**](https://developer.mozilla.org/en-US/docs/Web/API/Clipboard/readText), and that call only works when several conditions line up at once.

* **A secure context.** The page has to be served over HTTPS. A plain HTTP page cannot use the asynchronous clipboard read at all.
* **The document must be focused.** The tab has to be the active, focused one. A background tab cannot read the clipboard, so a site you opened and forgot about is not quietly watching.
* **A permission gate.** In Chromium browsers, Chrome, Edge, and friends, reading triggers a [“clipboard-read” permission prompt](https://support.google.com/chrome/answer/114662) the first time. Firefox asks differently, with a paste-confirmation button on every read. Either way, if you do not approve it, the read fails.

Put together, that means a web page cannot silently poll your clipboard in the background and exfiltrate everything you copy. It needs to be the page you are looking at, on HTTPS, and in Chromium it needs your say-so. That is a meaningful set of brakes.

## How do sites usually end up with what you copied?

Here is the part that actually matters day to day, and it has nothing to do with the read API. When you **paste** something into a page, the page receives it. A paste event hands the site exactly the text you dropped in, by design, because that is what pasting is for. No permission prompt, no API, no trickery: you chose to put that text into that field.

So the genuine risk is not a website reaching into your clipboard uninvited. It is pasting the wrong thing into the wrong place. Paste a password into a search box, or into the username field, or into a chat window you meant to close, and that page now has your secret because you handed it over. This is the everyday failure mode, and it is also why we wrote a dedicated guide, [is it safe to copy and paste passwords?](https://relic.space/blog/is-it-safe-to-copy-and-paste-passwords)

A page does not need to hack your clipboard to learn your secret. It just needs you to paste it into the wrong box. Slow down for a half second before pasting anything sensitive, and you have closed the most common gap.

## Can a website change what is on your clipboard?

Browsers are stricter about reading the clipboard than about changing it. Sites legitimately write to the clipboard all the time: the “copy” button next to a code snippet, a coupon code, a share link. That convenience has a shadow side called **pastejacking**, where a page makes sure that what lands on your clipboard is not quite what you thought you copied.

The classic example is a tutorial page with an install command. You click “copy,” expecting something like **curl https://example.com/install.sh | sh**. But the page quietly put a longer line on your clipboard, maybe the same command with an extra instruction appended after a newline. You paste into your terminal, and because a trailing newline can make a shell run the line immediately, the extra part runs before you have read it. Nothing “read” your clipboard here. The page wrote to it.

This is not a reason to panic about copy buttons, which are overwhelmingly benign. It is a reason for one specific habit: before you paste a command into a terminal, paste it into a plain text editor first, or at least read the whole line, and never let it auto-run. Terminals are the one place where a surprise in the clipboard turns directly into executed code.

A clipboard history that no website, and no server, can read.

Relic keeps everything you copy searchable across your devices, but every item is encrypted before it leaves your machine, so not even we can read it. See [how Relic encrypts your history](https://relic.space/technology).

[Download forWindows](https://relic.space/download/windows)[Download formacOS](https://relic.space/download/macos)[Download forLinux](https://relic.space/download/linux)[Download forAndroid](https://play.google.com/store/apps/details?id=relic.space.app&referrer=utm%5Fsource%3Drelic.space%26utm%5Fmedium%3Dwebsite%26utm%5Fcampaign%3Dcontent)[Download foriPhone](https://apps.apple.com/us/app/relic-clipboard-vault/id6800556025)

## Which browsers let JavaScript read the clipboard?

The clipboard API is not implemented identically everywhere, and the differences shape what a page can actually do.

### Chromium (Chrome, Edge)

Chromium offers the full asynchronous read, gated behind the secure context, focus, and the clipboard-read permission prompt described above. This is the most permissive of the major engines, and also the one that asks you first.

### Firefox

For years Firefox refused to expose the asynchronous clipboard read to web pages at all. That changed in 2024: Firefox 125 added support for **navigator.clipboard.readText()**, gated behind its own style of consent. Instead of a remembered site permission like Chromium’s, Firefox shows a small paste-confirmation button when a page asks to read text it did not put there itself, and the page only receives the text if you click it. No click, no read, and there is no way for a site to pre-approve itself.

### Safari and mobile

Safari requires a clear user gesture, a deliberate action tied to the read, rather than letting script read on its own. On phones the rules are tighter across the board. Mobile operating systems already guard the clipboard at the system level, iOS shows a banner when an app reads it, and mobile browsers inherit that cautious posture. If a behavior is going to be blocked anywhere, it is usually blocked on mobile first.

## Practical guidance that actually helps

You do not need to fear the browser. You need a few small habits that match where the real exposure is.

* **Do not paste secrets into pages you do not trust.** The paste itself is the handover. If you are not sure a site should have a value, do not paste it there. For moving a secret to someone safely, a [burn-after-reading private note](https://relic.space/tools/private-note) beats pasting it into a random form or chat.
* **Re-read before pasting into a terminal.** Drop copied commands into a text editor first, check the whole thing, and never let a pasted line auto-run. This defuses pastejacking entirely.
* **Keep your browser updated.** The clipboard guardrails live in the browser, and they get tightened over time. An out-of-date browser is the one most likely to have a loophole.
* **Be careful with extensions.** A web page is boxed in by the API rules. A browser extension you have installed can be far more dangerous, because it may be granted broad access to page content and, depending on its permissions, the clipboard, with no per-use prompt. Install few, from sources you trust.

If you want the full device-by-device checklist that goes beyond the browser, that lives in [how to keep your clipboard private](https://relic.space/blog/how-to-keep-your-clipboard-private). The browser is only one surface, and the same calm habits, paste deliberately, re-read commands, stay patched, apply everywhere your clipboard goes.

## Sources

* [Clipboard: readText() method](https://developer.mozilla.org/en-US/docs/Web/API/Clipboard/readText), MDN
* [Clipboard API](https://developer.mozilla.org/en-US/docs/Web/API/Clipboard%5FAPI), MDN
* [Change site settings permissions](https://support.google.com/chrome/answer/114662), Google Chrome Help
* [Copy and paste](https://developer.android.com/develop/ui/views/touch-and-input/copy-paste), Android Developers

## Frequently asked questions

Can a website read my clipboard without me knowing?+

Not silently. To read your clipboard, a page needs a secure HTTPS context, the tab has to be focused, and in Chromium browsers the user gets a clipboard-read permission prompt the first time. A background tab cannot quietly poll your clipboard. The everyday way a site sees clipboard data is simpler: when you paste into it, the paste hands the page exactly what you pasted.

Does Firefox let websites read the clipboard?+

Yes, since Firefox 125 in 2024, pages can call navigator.clipboard.readText(). Firefox gates reads behind its own kind of consent: a small paste-confirmation button appears near your cursor, and the site only receives the clipboard contents if you click it. Before that version, a Firefox page only got clipboard text when you actively pasted into it.

What is pastejacking?+

Pastejacking is when a page changes what ends up on your clipboard so that what you paste is not what you thought you copied. A site can set the clipboard from a copy button or intercept a copy action, then drop in different text, like an extra command appended to a terminal line. It is the reason to re-read anything before you paste it into a terminal.

Are browser extensions more dangerous than web pages for the clipboard?+

Usually yes. A web page is boxed in by the Clipboard API rules, focus, HTTPS, and permission prompts. A browser extension you have installed can be granted much broader access to page content and, depending on its permissions, the clipboard, with no per-use prompt. Install few extensions, from sources you trust.

JG

Written by

[Jordan Gibbs](https://relic.space/authors/jordan-gibbs)Founder, Relic

Jordan Gibbs is the founder of Relic, an end-to-end encrypted, permanent, searchable memory for everything you copy. He writes widely about AI, agents, and practical tooling on Medium, where he is read by tens of thousands, and builds privacy-first software. Here he covers how everyday tools like the clipboard actually work, and how to use them without handing your data to someone else.

[Medium](https://medium.com/@jordan%5Fgibbs)[GitHub](https://github.com/jordan-gibbs)[LinkedIn](https://www.linkedin.com/in/jordan--gibbs/)

Part of

[Clipboard security & privacy](https://relic.space/blog/topics/clipboard-security)
* [Is your clipboard a security risk?· pillar](https://relic.space/blog/is-your-clipboard-a-security-risk)
* [What is a passkey?](https://relic.space/blog/what-is-a-passkey)
* [Types of ciphers, from Caesar to AES](https://relic.space/blog/types-of-ciphers)
* [Which messaging apps are end-to-end encrypted in 2026](https://relic.space/blog/which-messaging-apps-are-end-to-end-encrypted)
* [Is it safe to copy and paste passwords?](https://relic.space/blog/is-it-safe-to-copy-and-paste-passwords)
* [What is end-to-end encryption, in plain English](https://relic.space/blog/what-is-end-to-end-encryption)
* [How to keep your clipboard private](https://relic.space/blog/how-to-keep-your-clipboard-private)
* [What is personally identifiable information (PII)?](https://relic.space/blog/what-is-personally-identifiable-information)
* [What is AES encryption?](https://relic.space/blog/what-is-aes-encryption)
* [What is zero-knowledge encryption?](https://relic.space/blog/what-is-zero-knowledge-encryption)
* [How to send a password securely](https://relic.space/blog/how-to-send-a-password-securely)

Keep reading

[Pillar·9 minIs your clipboard a security risk?Everything you copy lands in one shared slot of memory that other apps, and even web pages, can quietly read. What the clipboard exposes, and how to take the risk seriously without becoming paranoid.Read ](https://relic.space/blog/is-your-clipboard-a-security-risk)[8 minWhat is a passkey?Passkeys replace typed passwords with a key your device keeps and you unlock with your face or fingerprint. How they work, where they're stored, moving them between managers, and what to do if you lose your phone.Read ](https://relic.space/blog/what-is-a-passkey)[8 minTypes of ciphers, from Caesar to AESSubstitution, polyalphabetic, transposition and modern ciphers, each with a worked example you can check, and a quick guide to identifying an unknown cipher.Read ](https://relic.space/blog/types-of-ciphers)

securityprivacyclipboard