You open a site, and Chrome asks whether it may look at the clipboard. The clipboard is the place text goes after Copy. You may have just put a password, an SMS code, or a card number there. A site you hand that to will read the line as well as you can.
Allowing makes sense in a narrow case: you yourself typed the address of a bank or a payment you know, and you yourself pressed paste in the field you opened for that. In every other window, especially on a page from an email or an ad, press block. A closed tab does not cancel a permission already given. You remove it in the site settings.
What happens
When you copy text, it sits in the clipboard until you copy something else. The browser does not hand that text to every site by itself. The site has to ask permission, and Chrome shows the question. The buttons are usually Allow and Block. An accidental Allow on an unfamiliar page is exactly what opens what you copied.
Why an honest site wants the clipboard. You copy an order number, a confirmation code, or an amount, and you want to paste them into a field without a long typing. A payment you yourself started on the bank’s site sometimes offers to paste the details. At that moment the question is appropriate, and the address in the browser bar is the one you typed or opened from a bookmark in advance.
Why everyone else wants it. A password often stays in the clipboard, because a password manager or a note worked through copying. A code from a message stays. A card number you copied for another shop an hour ago stays. Someone else’s site with a continue button should not see that text. What you type yourself is enough for it, if you are going to type anything there at all.
The question can pop up as soon as the page opens, before you pressed paste. That is a weak sign. A normal paste happens when the cursor is already in the field and you yourself chose paste. A request to “allow the clipboard so we can show you a prize” or to check “browser security” has nothing to do with payment or with your field. Block it.
The permission is remembered for this site. Next time there may be no question, and the access remains. You can see it by the icon to the left of the address in Chrome: a lock or the site settings icon, then permissions. The clipboard row is blocked separately there. Names differ a little by version. Look for clipboard in this site’s permission list, not in someone else’s cleanup program.
A paste on your command and constant reading of the clipboard are not the same thing. You can refuse the site the right to read, and still press Paste yourself in the field you need, if the browser allows it. If after a refusal the site will not accept even a card typed by hand on an address you did not type, leave it. Open the real payment again, with your own address.
What to check, in order
- Read Chrome’s question. If it is the clipboard, remember what you copied last: a password, a code, a card, or a harmless phrase.
- Look at the site address. Did you type it yourself, or open it from your bookmark, specifically for a payment or to enter a code? If not, press Block.
- If the page came from an email, an ad, or a short link, do not allow the clipboard, even if the picture shows your bank.
- Permission is appropriate when payment is already going on a familiar site and you yourself want to paste a code or details into a field.
- After an accidental Allow, press the icon to the left of the address, open site settings, and block the clipboard.
- After that, copy a neutral word, for example a period, so the old password or card does not stay in the clipboard for the next site.
- Change a password that already sat in the clipboard on a doubtful page, in the service that password belonged to. From your own device, not on that page.
- Do not install an extension “to protect the clipboard” from an unfamiliar site. The block button in Chrome is enough.
Where people usually go wrong
- They press Allow without reading, because the window gets in the way of finishing an article or a video.
- They allow the clipboard on a site from an email where the bank logo is, even though they did not type the address.
- They think the cross on the tab erases the permission. It stays with the site until you block it.
- They copy a whole password and then open several tabs in a row. The password is still in the clipboard.
- They look for the setting in a random cleaner, even though the switch sits by the page address in Chrome.
The clipboard can hold a password and a card number. Allow it only if you yourself started the payment on a site whose address you typed. In other cases, block it.
What to do today
Remember whether you pressed Allow on a clipboard question in the last few days. Open Chrome, go to the sites you doubt, and by the icon to the left of the address block the clipboard, if this is not your bank and not a payment you yourself started. Answer a new question with a block, until the address is the one you typed by hand for a specific payment or code. After you copy a password or a card, paste it only into the field you need, and then copy a harmless word so the line does not stay in the clipboard. If a password may already have been read on someone else’s page, change it from your phone.
Apps on the phone have the same extra requests. The text about extra app permissions covers them. A password you copy should not match the computer sign-in: there is a note about a password to sign in to the computer.
