EnClip

EnClip is a local-first clipboard history app for macOS. Clipboard contents are encrypted as soon as they are captured, and reading history requires Touch ID or the macOS authentication fallback. The name refers to the Secure Enclave-backed key that protects the vault.

Warning

EnClip is early-stage software handling sensitive clipboard data. It has automated tests and a documented security model, but it has not received an independent security audit. Do not treat it as protection against malware or an already-compromised Mac.

Highlights

• Encrypt-only background capture using ephemeral P256 ECDH, HKDF-SHA256, and AES-GCM.
• Secure Enclave P256 key agreement key protected by user presence.
• Touch ID-gated, in-memory history with search and pinning.
• Plain text, RTF, HTML, PNG/TIFF image, and file-URL restoration.
• Locked UI reveals no history rows, previews, or entry count.
• Configurable global shortcut (⌘= by default) and keyboard navigation.
• Optional direct paste with an explicit macOS Accessibility permission.
• Panic wipe destroys ciphertext and the Keychain representation of the enclave key.
• No analytics, update checks, remote assets, third-party packages, or network features.

Requirements

• macOS 14 or later.
• Apple silicon or another Mac with a Secure Enclave.
• Xcode Command Line Tools with Swift 5.10 or later.

EnClip is currently distributed as source code. Official notarized binary releases are not available yet.

Build from source

git clone https://github.com/AlieGG/EnClip.git
cd EnClip
make doctor
make test
make run

make run creates an ad-hoc-signed development build by default. A stable local signing identity avoids repeated Keychain trust prompts across rebuilds:

SIGN_IDENTITY="EnClip Local Development" make bundle
open build/EnClip.app

The signing identity and its private key belong in your login Keychain and must never be committed. If you create a self-signed identity, use a non-CA leaf certificate constrained to code signing, as shown by scripts/enclip-local-signing-openssl.cnf. Release binaries should use an Apple Developer ID Application certificate and notarization.

Useful commands:

make build    # Compile EnClip
make test     # Run the test suite
make bundle   # Assemble build/EnClip.app
make verify   # Validate metadata and code signature
make clean    # Remove only repository-local build output

How it works

EnClip polls the general pasteboard every 750 milliseconds. Supported representations are serialized to a binary property list and immediately encrypted with an ephemeral P256 key agreement, HKDF-SHA256, and AES-GCM. The capture path receives only the public-key encryption capability.

SQLite stores ciphertext plus limited plaintext metadata: capture time, source application, advertised types, byte size, and pin state. It has no plaintext content or preview column. Capture is limited to 128 items, 32 representations per item, 50 MB per representation, and 100 MB total.

Unlocking creates a fresh authenticated LAContext, reconstructs the Secure Enclave private-key capability, and decrypts entries into memory. Closing the popover, reaching the idle timeout, locking the screen, or sleeping relocks the vault and releases decrypted state.

See SECURITY.md for the threat model and important limitations.

Permissions

Clipboard access

Clipboard access is the core function of EnClip. On macOS 15.4 and later, the app reports the system pasteboard permission state and does not bypass a denial.

Accessibility

Accessibility permission is optional and used only for direct paste. A normal row click restores an entry to the clipboard. The direct-paste button additionally returns focus to the previous app and synthesizes one ⌘V. Without permission, EnClip falls back to copy-only behavior.

Launch at login

This is optional and managed through SMAppService. macOS may require confirmation in System Settings → General → Login Items.

Data location and removal

Encrypted history is stored at:

~/Library/Application Support/EnClip/history.sqlite3

The enclave key representation uses Keychain service local.enclip.EnClip and account vault-key-v1.

Use the in-app panic wipe before uninstalling if you want cryptographic erasure. Deleting the Keychain item makes retained ciphertext permanently unreadable. APFS and SSD behavior mean physical byte erasure cannot be guaranteed.

Project status

EnClip is a beta-quality personal project. Before a general binary release, the project still needs independent security review, notarized release automation, broader manual hardware testing, and a polished first-run experience.

Bug reports and security reviews are welcome. Please read CONTRIBUTING.md and SECURITY.md first.

License

EnClip is licensed under the GNU Affero General Public License v3.0. Commercial use is permitted under the AGPL, subject to its terms.