A clipboard manager sees everything you copy, so it has to be clear about what it keeps, where, and who can get at it. This page is the complete picture for Keepit. The code is open (github.com/andrey-insarov/Keepit), so every claim here can be checked against it.
Keepit stores your clipboard history and templates in one folder on your Mac and nowhere else. There is no account, no cloud, no analytics, and the app makes exactly one kind of network request: the daily update check against GitHub. Copies from password managers are never recorded. If you set a password, everything on disk is AES-256-GCM encrypted with a key derived from that password; the key exists only in memory, is wiped when Keepit locks, and can optionally be released by Touch ID from the Secure Enclave. A 24-word recovery phrase is the only way back in if you forget the password — Keepit itself cannot reset it.
Everything lives in ~/Library/Application Support/Keepit/ (App Store edition: the app's container
under ~/Library/Containers/com.it.keep/):
| File | Contents | Encrypted with a password? |
|---|---|---|
history.json |
The clipboard history: text, RTF, HTML, PNG images, file lists, with date and source app | Yes |
templates.json |
The template tree, including per-template hot keys | Yes |
settings.json |
Preferences: hot keys, limits, ignore list — no clipboard data | No |
vault.json |
Encryption metadata: PBKDF2 salt, a sealed verifier, the wrapped recovery material | — |
The history is written when it changes and read on launch. Without a password the JSON is plain text on disk, protected only by your macOS account and FileVault. Preferences → Advanced → Open Data Folder shows the folder.
Keepit also writes to the macOS keychain — only the Touch ID entry described below — and registers itself as a login item if you let it start at login.
org.nspasteboard.ConcealedType,
org.nspasteboard.TransientType). Password managers and many terminals set these.Note that Keepit cannot tell a password typed into a form from any other text if the app that put it on the clipboard did not mark it. Use the pause, or the ignore list, for such apps.
Turn on Require password at launch and the history and templates files are encrypted:
vault.json; nothing else derived from the password is written
except a small GCM-sealed verifier that lets Keepit tell a wrong password from corrupt data.mlock) buffer that is never swapped
out and is overwritten with memset_s when Keepit locks or quits. A CryptoKit key object is built
only for the duration of one call and discarded.⌥L), quitting, and — on by default — the screen locking
or the Mac sleeping wipe the key and unload the decrypted history and templates. After that nothing
readable is in memory until you unlock again.Changing the password re-wraps the recovery material; the data files are re-encrypted with the new key.
With Unlock with Touch ID on, Keepit stores a copy of the data key in the keychain under an access
control of kSecAttrAccessibleWhenUnlockedThisDeviceOnly + biometryCurrentSet. That means:
The password keeps working as a fallback and is still required to change the password itself unless you allow Touch ID for that too. Turning Touch ID off deletes the keychain entry.
When you set a password Keepit generates 32 bytes of entropy and shows them once as a 24-word BIP-39-style phrase (2048-word English list, 8-bit checksum to catch typos). A key derived from that entropy (HKDF) wraps the data key, and the entropy is in turn wrapped by the data key, so:
The phrase itself is never written to disk. Print it, or keep it in a password manager. Without the password, Touch ID on the same Mac, or the phrase, the data is unrecoverable by design — there is no server-side reset and Keepit's authors cannot help.
Export Backup… produces one .keepit file: a magic header, a format version, a random 16-byte
salt, and the LZFSE-compressed JSON of history, templates and preferences sealed with AES-256-GCM
under a PBKDF2 key from a password you choose for the file. The file is safe to keep on a cloud
drive; its password is independent of the app password. Import Backup… verifies the
authentication tag before using anything.
| Permission | Why | What happens without it |
|---|---|---|
| Accessibility | To send ⌘V to the app you were working in, and to find the text cursor so the menu opens there | Items are copied to the clipboard; you press ⌘V yourself; the menu opens at the pointer |
| Touch ID / keychain | Only if you enable Touch ID unlock | Password only |
| Login item | Launch at login (on by default, switchable on General) | Start Keepit by hand |
Keepit does not ask for Full Disk Access, Screen Recording, Input Monitoring, Contacts, Calendars, Location or the camera, and does not use any of them. The Accessibility permission is powerful — it is the same one window managers and automation tools need — which is why the app is signed and notarized and the source is public.
The direct-download edition makes one request: once a day (and when you choose Check for Updates…) it fetches the Sparkle appcast from GitHub Releases over HTTPS. Updates are verified with an EdDSA (Ed25519) signature embedded in the app before they are installed; a download that does not match is rejected. The App Store edition is updated by the App Store and makes no requests at all.
No clipboard content, no usage data and no identifiers are ever sent anywhere. There is no crash reporter and no analytics library in the binary.
Every release is built on GitHub Actions from a tagged commit, signed with the Developer ID of UK
Intis Telecom LTD, notarized by Apple and stapled. The release page carries, for each DMG, a
.dmg.sig (Sparkle EdDSA signature) and a SHA256SUMS file. To verify a download by hand:
shasum -a 256 -c SHA256SUMS --ignore-missing
spctl -a -vv -t install Keepit-2.9.1.dmg # "accepted, source=Notarized Developer ID"
Homebrew installs the same DMG from the same release.
Preferences → Advanced → Delete Keepit and All Data… removes the app bundle, the data folder, the
keychain entry, the login item and the Accessibility grant, after asking for the password or Touch
ID and a typed confirmation. Deleting the app by hand leaves the data folder in place — remove
~/Library/Application Support/Keepit/ yourself if you want it gone.
Please use GitHub's private vulnerability reporting (Security → Report a vulnerability on the repository) or write to dp@intistele.com rather than opening a public issue. You will get an answer within a few days, and a fix is released as soon as it is ready; credit is given if you want it.