Should I vibe code
Store a local encrypted clipboard history with search, pinboards, and expiration
The clipboard manager is a day's work. Making the same secrets appear on three devices is the actual product.
?
Their verdict, the Personal price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
That clipboard history is a plaintext log of every password you copied is argued elsewhere on this site and it still holds — cap it, encrypt it, expire it, keep it out of anything that syncs. What is specific to Paste is the part people forget it does: the same history on your Mac, your phone and your iPad. That is the feature, and it is also why the honest build is the local one. Syncing a store like this means key material on three devices, a revocation story for the one you sold, conflict resolution when two of them truncated the history while offline, and tombstones designed so that deleting an item removes it from the record rather than adding a row saying it is gone. None of that is exotic and all of it is more work than the app around it. There is a second thing worth knowing before you start: this app types into other apps. A clipboard manager is one off-by-one away from pasting the wrong item into a Slack channel, and one newline away from a terminal executing what it received. Build the local version — a pasteboard poller, a searchable store and a hotkey is a genuinely good day — and let the subscription buy the part that follows you to your phone.
What actually breaks
not "if". the specific failures.
- The paste itself: multi-line content sent to a terminal runs at the first newline, and clipboard histories are full of multi-line content
- An off-by-one in the stack, so the hotkey pastes the item above the one you meant — fine until the item above is an API key and the window is a public Slack channel
- Rich text versus plain, where pasting a styled fragment ships the source formatting, the tracking parameters and occasionally the author's name
- The concealed-type pasteboard flag that password managers set, which you will only honour if you knew it existed
- macOS pasteboard privacy changes, which have broken every polling clipboard manager at least once and will again
- Sync, once you add it: an item deleted on the laptop that reappears from the phone an hour later
- The store growing to a gigabyte because nothing expires and every screenshot you copied is still in it
- Universal Clipboard and Handoff, fighting your poller for the same pasteboard and winning intermittently
Is that you?
the verdict is a default, not a law
- It runs on one machine, stores history inside the app container, and nothing about it is on a network
- The store is encrypted with a key from the Keychain, capped by count and age, and excluded from Time Machine and any synced folder
- You honour the concealed-type flag and keep an ignore list of applications, with password managers on it by default
- You accept re-fixing pasteboard behaviour roughly once per macOS release
- You are adding cross-device sync without designing key management, device revocation and deletion tombstones first — that is the product, not a feature
- The history file lives in Documents, Desktop, iCloud Drive or a Dropbox folder
- You are distributing it, at which point notarisation, entitlements and explaining the Accessibility prompt become a support job
- You intend to paste by simulating keystrokes into arbitrary applications without a preview of what is about to be typed
If you build it anyway
the checklist, then the prompt that enforces it
- Keep the store inside the app container, encrypted with a Keychain key, and explicitly excluded from backups and from every sync client on the machine.
- Honour org.nspasteboard.ConcealedType and skip capture entirely when the frontmost app is on an ignore list. Ship that list populated with the common password managers.
- Cap by count and by age, expire on a timer, and provide one keystroke that deletes the file rather than emptying a table.
- Show what is about to be pasted. A preview line is the difference between a mispaste and an incident, especially in a terminal.
- Strip trailing newlines by default when pasting into a terminal, and treat multi-line pastes as needing an explicit confirmation.
- Preserve every pasteboard representation you captured and let the paste choose — plain text should be a first-class hotkey, not a menu item.
- If you add sync, do end-to-end encryption with a key that never leaves the devices, per-device revocation, and deletions that propagate as tombstones which themselves expire.
- Never log a clipboard item — not to a file, not to a crash report, not to an analytics event. There is no analytics in this app.
I am building a macOS clipboard manager for myself: history, search, pinned
snippets, expiry. It will hold passwords and one-time codes whether I intend it
to or not, and it types into other applications. Apply these and push back when
I ask you to relax one.
1. Storage first. History lives in the app container, encrypted with a key from
the Keychain, excluded from Time Machine, iCloud Drive and any Dropbox-style
folder. Never Documents or Desktop.
2. Capture rules before capture features: honour the concealed-type pasteboard
flag, skip capture when the frontmost app is on an ignore list, and ship that
list populated with the common password managers.
3. Cap history by count and by age with a default expiry in days, and give me a
delete-everything action that removes the file, not the rows.
4. Preserve every pasteboard representation for an item and let paste choose
between them. Plain-text paste gets its own hotkey.
5. Before pasting, show me what will be pasted — a one-line preview with a
visible indicator when the content spans multiple lines.
6. Treat pasting into a terminal as a special case: strip the trailing newline
and require confirmation for multi-line content. Say in the README that a
pasted newline is an executed command.
7. Never write clipboard contents to a log, a crash report or telemetry. There
is no telemetry.
8. Assume macOS will change pasteboard behaviour. Isolate the polling in one
file, document what it depends on, and fail closed.
9. Do not implement cross-device sync in this pass. If I ask, stop and make me
design key distribution, device revocation and deletion tombstones first — a
deleted secret that returns from another device is worse than no sync.
10. Out of scope: distribution, licensing and auto-update. This is unsigned and
for me. If I change my mind, remind me Paste sells a lifetime licence for
less than notarisation will cost me in an afternoon.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
If you want the history on your phone. That is what the subscription is for, and the sync design underneath it is genuinely the hard part of this product. Roughly $4 a month, or a one-off lifetime licence, against a weekend for the local version and considerably more than a weekend for a sync layer you would then have to trust with your passwords. Build the local one because it is a good build; buy the sync because it is a bad one to get slightly wrong.
$3.99/mo is cheaper than your weekend.
Deleting the app is the whole exit, with one deliberate step: remove the history store yourself rather than leaving a month of copied secrets in Application Support long after the thing that wrote them is gone. Anything you pinned is worth keeping, so give pinboards a plain export — one Markdown or JSON file of your saved snippets — because those are the part with actual value, and they are also the part that trivially moves into any other clipboard manager.
The canonical open-source macOS clipboard manager, actively maintained, with the ignore-list and concealed-type handling already worked out.
Cross-platform text expander — adjacent rather than identical, and the better reference if what you actually want is the pinned-snippets half.
Questions
Another clipboard entry says the same thing about credentials. What is new here?
The credentials argument is shared and unavoidable, so treat it as settled. What is specific to Paste is that its selling point is the history existing on three devices at once. Sync turns a local secrets file into a distributed one, and distributed secrets need key management, device revocation and deletions that actually propagate — none of which is a weekend, and all of which is invisible until it fails.
Is the terminal paste really a risk worth naming?
It is the one failure in this app that acts without you. Shells execute on the newline, so a multi-line item pasted into a terminal runs its first line immediately, before you have read it. Add a preview and strip the trailing newline and the whole category goes away for about twenty lines of code.
Why is buildEase lower than the upstream YES suggests?
Because it is AppKit rather than a web app. Models are noticeably weaker at Swift, global hotkeys, pasteboard type handling and menu-bar lifecycle than they are at React, and the pasteboard specifically has behaviour that changes between macOS releases. It is still a very achievable build — just not the one-evening one the estimate implies.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
last reviewed 2026-08-04 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice