Is there a danger of my clipboard data being harvested by a web app or site that I visit?

I would like to stay safe, but I want to keep JavaScript enabled to give a better user experience.

2 Answers 2


Most modern browsers will not allow JavaScript to access your clipboard without at least a warning. It's plugins such as Flash that you need to worry about.

For more information, see MozillaZine's article which states:

By default, JavaScript is not allowed to read or set your clipboard data for security and privacy reasons. This is because websites scripts can erase and replace what you currently have in your clipboard (data loss issue) and they can read whatever you have in your clipboard (security and privacy issue); as such, you should grant access with caution.

There are extensions such as AllowClipboard Helper for Firefox which should let you decide exactly which sites have access to your clipboard.

  • or java applets ...
    – akira
    Commented Jul 18, 2010 at 17:17
  • @akira Untrusted Java applets should only get clipboard data if you explicitly copy/paste in that applet. Commented Jul 28, 2010 at 15:49

Yes there is definitely a danger that websites can access your clipboard data.

On desktop browsers, it may be true that this can happen only if you have granted permission or dismissed a warning dialog. But while the permission may have been granted at a particular moment for a particular purpose, the permission lingers beyond that particular moment and purpose, granting the website the ability to read your clipboard whenever the document is focused.

So for instance:

  • you grant a web page permission to paste a cat image to a meme generator.
  • you change tabs to your bank's website, and copy/paste your password to login.
  • you return to the cat page to see the meme.
  • The meme generator site can see the bank password in the clipboard contents.

For mobile devices, it appears that the clipboard is accessible to any application


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.