You paste into Claude all day. The day the clipboard holds a live AWS key, PasteSentry stops ⌘V mid-keystroke and hands Claude a file path instead.
Download for Mac · free · macOS 13+Every copy is classified on your Mac in under a millisecond. A match arms the shield in your menu bar, silently.
One keypress saves the secret to ~/.secrets/, locked to your user, and pastes the path where the key would have been. Claude Code can still use it. Nobody else ever sees it.
Detection, the vault, the log: all local.
Its own update check. That's the whole list.
⌘V outside guarded apps is untouched, with zero added latency.
Notarized by Apple. Auto-updates itself.
Keyboard ⌘V only. Drag-and-drop and pbpaste aren't guarded in v1. A last line of defense, not a guarantee: unknown secret formats can slip past. The vault is plaintext chmod 600, the same trust level as ~/.aws/credentials; FileVault is your at-rest encryption. And an agent can still read the vaulted file if you let it. A one-click rule adds a Claude Code deny for the vault, while Bash access stays permission-prompted. Seatbelt, not cage.
Also worth knowing: everything you paste into Claude Code is saved in plaintext on your own disk, in ~/.claude/projects/**.jsonl. The best paste is the one that never happened.
No account. No tiers. No catch. Auto-updates in place.
Download PasteSentry · 1.0.0 · universal