Clear the clipboard 60 s after copying a recovery key / invite token — with a visible countdown #156

Closed
opened 2026-09-17 22:49:24 -04:00 by jared · 1 comment
Owner

Jared: only if it is obvious to the user. After "Copy" on the recovery key (backup setup/restore) and on invite tokens/links with embedded secrets, show a small inline countdown on the button — "Copied · clears in 60 s" ticking down — and at zero write an empty string to the clipboard only if the clipboard still holds our value (navigator.clipboard.readText() where permitted; otherwise skip the clear rather than wiping something else the user copied). Cancel the timer if the user copies something else in the app. Setting-free.

Jared: only if it is obvious to the user. After "Copy" on the recovery key (backup setup/restore) and on invite tokens/links with embedded secrets, show a small inline countdown on the button — "Copied · clears in 60 s" ticking down — and at zero write an empty string to the clipboard **only if the clipboard still holds our value** (`navigator.clipboard.readText()` where permitted; otherwise skip the clear rather than wiping something else the user copied). Cancel the timer if the user copies something else in the app. Setting-free.
jared added this to the Features 2026-Q4 milestone 2026-09-17 22:49:24 -04:00
jared added the enhancementpriority: lowsecurityuxarea: auth-session labels 2026-09-17 22:49:24 -04:00
jared self-assigned this 2026-09-17 22:49:24 -04:00
Author
Owner

Done in 9363629e: the recovery key's Copy button becomes Copied · clears in 60 s and counts down; at zero the clipboard is cleared only if it still holds the key (readText() where permitted — if the browser refuses to read, nothing is wiped rather than risk eating something else). Any other copy made in the app cancels the timer. No setting. The invite link isn't covered on purpose: it's a matrix.to permalink, not a secret. Verified headless with a fake clock: countdown ticks, clipboard emptied at 0; copying something else mid-countdown cancels and leaves that content untouched.

Done in `9363629e`: the recovery key's Copy button becomes **Copied · clears in 60 s** and counts down; at zero the clipboard is cleared only if it still holds the key (`readText()` where permitted — if the browser refuses to read, nothing is wiped rather than risk eating something else). Any other copy made in the app cancels the timer. No setting. The invite link isn't covered on purpose: it's a matrix.to permalink, not a secret. Verified headless with a fake clock: countdown ticks, clipboard emptied at 0; copying something else mid-countdown cancels and leaves that content untouched.
jared closed this issue 2026-09-19 23:19:59 -04:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#156