Zero-Knowledge Clipboard Syncing: A Technical Deep Dive

Introduction

Clipboard contents are highly sensitive. Developers frequently copy raw tokens, configuration parameters, snippets, or passwords. Synchronizing this text between devices usually involves query registers on remote servers, introducing security vulnerabilities. CoShareX implements zero-knowledge clipboard channels that run locally.

The Risk of Centralized Clipboards

Standard operating systems and cloud services sync clipboards by uploading everything you copy to an online database. If a database is breached or intercepted, your passwords and keys are compromised. Local-first syncing removes this server vulnerability.

The Web Crypto API Framework

CoShareX generates AES-GCM symmetric keys directly inside the client sandbox using the browser's crypto module. The key is stored in volatile memory and never shared with signalling proxy servers.

// Generate 256-bit AES-GCM symmetric key
async function generateSymmetricKey() {
  return await window.crypto.subtle.generateKey(
    {
      name: "AES-GCM",
      length: 256
    },
    true, // extractable
    ["encrypt", "decrypt"]
  );
}

AES-GCM Encryption Sequence

To sync copied text, the sender encrypts the string using the local symmetric key and a random 96-bit initialization vector (IV) to prevent cryptographic duplication patterns. Below is the workflow comparison:

Best Practices for Crypto Keys

• Avoid reusing initialization vectors (IVs). Use window.crypto.getRandomValues to guarantee a unique IV for each payload.
• Use AES-GCM over older algorithms like AES-CBC to secure authenticated integrity checks.
• Store active keys in session scopes to clear credentials once browser tabs are closed.