Nothing gates a clipboard read
macOS has permission gates for the camera, the microphone, the screen and your files. The pasteboard has none. Any process in your user session can call the API and read what you copied, whenever it likes.
The size of that habit showed up on iOS first. In 2020, security researchers Talal Haj Bakry and Tommy Mysk found 53 popular apps reading the pasteboard without any reason to, and Apple's answer in iOS 14 was a banner telling you when an app had pasted from another app. macOS never got that banner.
The three settings worth changing
1Password clears the clipboard 90 seconds after you copy a password. Check yours is on. It limits how long the value sits in the slot, and it is the single most useful setting in this list.
Firefox 94 stopped feeding copied passwords into clipboard history. Copies made on a password page or inside a private window no longer go into the OS clipboard history, tracked as CVE-2021-38505. Older Firefox builds did pass them through.
Klipto has a password-manager exclusion in Settings, then General, and it is off until you switch it on. That is worth saying plainly rather than pretending it ships enabled. Turn it on, and copies coming from a password manager are dropped instead of recorded.
Recording changes the exposure window. A password sitting in the clipboard for 90 seconds is a narrow risk. The same password written into a searchable history is there until something removes it, which is the honest cost of every clipboard manager, including mine.
Klipto's history is local: no account, no sign-in, no sync, and the app touches the network only to check for updates. You can wipe all of it in one action, or set it to drop items by age or by total size.
The trap
The exclusion only covers password managers. A password you copy out of a web page, a text file or a message still gets recorded, because there is nothing in the copy to mark it as sensitive. Klipto flags likely passwords by shape when it detects a type, and that is a guess, not a guarantee.
Universal Clipboard sends your copies off the Mac. With Handoff on, what you copy is available on your iPhone and iPad. Useful, and worth knowing before you copy a card number.
Cloud sync in a clipboard manager doubles the surface. Anything synced sits on someone's server as well as your disk. If you want the convenience, read what the vendor says about encryption first.
What I use
Klipto keeps everything on the Mac and asks for no account. That was a design decision, and it is also why there is nothing to breach. If you want free local clipboard history, Maccy is a fine answer and stores locally too.
The dull advice beats any setting: use autofill instead of copying a password, and clear the history before you share your screen.