The Guide to Text Formatting and Safe Copy-Pasting
You copy a paragraph from a webpage and paste it into an email. Suddenly, your font changes to Arial, the text is highlighted in a weird gray background, and there are three invisible hyperlinks.
That's the annoyance of Rich Text. But there's a much darker side to how your clipboard handles data: a security exploit called pastejacking.
Here is how to sanitize your text for both aesthetics and security.
The Rich Text Annoyance
When you highlight text on a webpage and hit copy, your operating system doesn't just copy the letters. It copies the HTML payload — the fonts, the colors, the sizes, the background, and the hyperlinks.
When you paste that into a Rich Text editor (like Word, Gmail, or Apple Notes), the editor tries to faithfully reproduce all that HTML. The result is a formatting disaster that takes more time to fix than if you had just retyped the sentence.
The First Line of Defense: The Shortcut
Before you use any external tools, you should memorize the "paste as plain text" shortcut. It forces your OS to drop the HTML payload and only paste the raw characters.
- Windows/Linux:
Ctrl + Shift + V - macOS:
Cmd + Shift + V(orCmd + Option + Shift + Vin some apps)
This solves 80% of formatting issues. But it has two flaws:
- It doesn't work in every application (some apps ignore the "Shift" modifier).
- It doesn't protect you from pastejacking.
The Security Threat: Pastejacking
Pastejacking is a malicious technique where a website uses JavaScript to alter the contents of your clipboard the moment you hit Ctrl + C.
Imagine you're reading a tutorial and you copy this innocent-looking command to paste into your terminal:
git clone https://github.com/example/repo
A pastejacking script intercepts your copy command and actually places this in your clipboard:
git clone https://github.com/example/repo; rm -rf /
If you paste that directly into your terminal and hit Enter (or if the malicious payload includes a newline character, which executes it instantly), your hard drive is wiped. You never even saw the malicious code.
The Solution: The Visual Airgap
When you are copying code, terminal commands, or wallet addresses from an untrusted source, you should never paste them directly into a sensitive environment (your terminal, your crypto wallet, your production database).
You need a visual airgap — a place to paste the text, strip its formatting, and look at it before it can execute.
This is exactly what Web Clipboard provides.
- Copy the text from the suspicious source.
- Paste it into the Web Clipboard. The browser environment instantly strips all rich text formatting, neutralizing hidden HTML.
- Inspect the raw text visually. If there is a malicious payload appended to the end, you will see it clearly in the text block.
- Recopy the sanitized, verified text and paste it into your terminal.
The Rule for Copy-Pasting
- For internal emails and documents: Use
Ctrl + Shift + Vto save time and fix formatting. - For terminal commands, code, and financial data: Route it through Web Clipboard first.
Taking three seconds to sanitize your clipboard could save you from hours of formatting headaches — or a catastrophic system compromise.
Loading comments...