Everything PasteShield checks before you paste.
Category-specific detection, not a black box. Here’s exactly what it looks for.
API Keys
OpenAI, Anthropic, AWS, GitHub, GitLab, and Stripe key formats, matched by their known prefixes and structure.
sk-ant-••••••••••••Bearer Tokens & JWTs
Authorization headers and encoded JWT payloads, decoded locally just enough to confirm the pattern.
Bearer eyJhbGciOi••••••Passwords in Code
Hardcoded credentials in config files, .env dumps, and inline scripts.
DB_PASSWORD=••••••••DB Connection Strings
Postgres, MySQL, MongoDB, and Redis URIs with embedded credentials.
postgres://user:••••@host/dbPrivate Keys
PEM and SSH private key blocks, matched at the header/footer boundary.
—–BEGIN PRIVATE KEY—–Custom Rules
Define your own patterns for internal tokens, proprietary formats, or company-specific identifiers.
ACME_INTERNAL_••••••Free vs. Pro
| Feature | Free | Pro (€29 one-time) |
|---|---|---|
| Safe Paste shortcut (⌘⇧V) | Included | Included |
| Core detector set | Full | Full |
| Custom rules | Up to 3 | Unlimited |
| Automatic sanitization | — | Trusted categories |
| Advanced, high-entropy detection | — | Included |
| Per-app settings | — | Included |
| Rule import/export | — | Included |
Frequently asked questions
No, never. Detection runs entirely on-device, with no network calls.
No tool can guarantee that. PasteShield meaningfully reduces risk — it doesn’t eliminate it.
Not for the free tier.
PasteShield doesn’t keep a history of anything you copy. It’s a security tool, not a convenience tool.