Does Maccy see your passwords?

How the protection works

macOS lets an app flag a clipboard item as concealed or transient — a signal that says “do not retain this.” Password managers such as 1Password, Bitwarden, and Apple Passwords set this flag when you copy a password. Maccy honours it and skips those items, so they do not appear in your history. You do not have to configure anything for this to work.

The one case to watch for

The flag is set by the source app. If you copy a password from a manager, it is concealed and ignored. But if you copy a password as plain text from a regular field — say, a password typed into a Notes document or a web form that does not conceal it — macOS has no signal that it is sensitive, so Maccy would store it like any other text.

The takeaway: let your password manager handle credentials (it conceals them), and avoid copying secrets out of ordinary text fields you do not control.

Extra safeguards

• Ignore sensitive apps: add banking, 2FA, or other apps to Settings → Ignore so nothing from them is captured — see the ignored-apps guide.
• Clear when needed: if something sensitive did get stored, clear your history.
• Keep a modest history limit: less retention means a shorter exposure window (retention and size limits).

Why you can trust this

Maccy is open source, so the concealed-type handling is right there in the code to verify — you are not relying on a marketing promise. That auditability is a core reason it rates well for safety; see the full privacy & security review.

The complete answer

No — Maccy does not store your passwords in its clipboard history. This is not a marketing promise. It works through two independent technical mechanisms.

Mechanism 1: The default ignore list

Maccy ships with 1Password, Bitwarden, Dashlane, and macOS Keychain on its ignore list. When these apps write to the clipboard, Maccy sees the write event but does not record it. The item is available for your one paste, then gone from Maccy's perspective.

This is configured in Maccy Preferences → Ignore. You can view, add, or remove apps from this list at any time.

Mechanism 2: macOS secure clipboard flag

Beyond Maccy's own ignore list, macOS itself has a "secure" clipboard flag. Password managers set this flag when writing sensitive data. Apps that receive a clipboard write with the secure flag — including Maccy — are expected to not persist it. Maccy honours this flag.

This means even if a password manager is somehow not on Maccy's ignore list, the secure flag provides a second layer of protection.

How to verify it yourself

1. Copy any non-sensitive text first (note: this becomes item 1 in Maccy)
2. Copy a password from 1Password or Bitwarden
3. Immediately open Maccy (Cmd+Shift+C)
4. Item 1 should be the text you copied before — not the password
5. The password does not appear anywhere in the list

This test works because Maccy records items as they arrive. If it had recorded the password, it would appear at position 1. Its absence confirms the ignore list is working.

What if you use a password manager not on the default list?

If you use NordPass, Keeper, Enpass, or another manager not in Maccy's defaults, add it manually:

# Find bundle ID for any app:
osascript -e 'id of app "NordPass"'
# Returns: com.nordpass.macos

Open Maccy Preferences → Ignore → click + → add the bundle ID.

Is the open-source code verifiable?

Yes. Maccy's source is at github.com/p0deje/Maccy. The ignore list implementation and secure clipboard flag handling are publicly readable. Security researchers and enterprise IT teams have audited this code. There is no hidden recording of password manager activity in the codebase.