emersion.fr/…/wayland-clipboard-drag-and-drop/

The source client needs to be the currently focused application. This prevents background applications from unexpectedly changing the clipboard contents right before the users pastes it.

The destination client needs to listen to wl_data_device events to keep track of the current clipboard contents. The destination client will only receive such events if it’s focused. This prevents background applications from arbitrarily reading the clipboard (which may contain sensitive data such as passwords).

The graphical application must be in focus to gain access to the clipboard, and wayland is designed to prevent such focus stealing*. As mentioned earlier, password managers such as keepassxc will automatically clear your clipboard after copying sensitive data - this is a configurable behavior. This means that no other application should have the opportunity to steal focus, and your clipboard should be cleared of sensitive content before you open up a privacy dismissive application that wants to surveil your clipboard.

*I need to do a bit more digging to find further verification of this focus stealing prevention behavior of wayland, and if I can find that information I will cite here.

I noticed you were discussing the “notepad”, are you talking about the windows operating system? I cannot speak on its clipboard management, unfortunately. That said, I would not run the windows operating system if I cared about privacy. The erosion of privacy destroys any semblance of security, eh?

Edit: Following up, I did find some information from the vim text editor that discusses stealing focus in wayland. You can read about it here vimhelp.org/wayland.txt.html#wayland-focus-steal . So far, it appears as though applications do not have access to the clipboard unless focused, which is a design on wayland’s part to secure this. However, vim is showcasing a way to steal focus and thus subvert this security effort? It does note that if you are in a full screen mode then it cannot steal focus. Anyway, more reading to be done still. There appears to be methods of determining an application is doing this “focus stealing”

Note that this method can have several side effects from the result of focus stealing. For example, if you have a taskbar that shows currently opened apps in your desktop environment, then when Vim attempts to steal focus, it may “flicker,” as if a window was opened then immediately closed after.

So with this behavior in mind, and with the way the clipboard works, no application would know what contents are inside the clipboard until in focus. Therefor an application would either have to “guess” when sensitive content is available, or steal focus quite often. The former being unlikely, and the latter most likely being able to be detected by the user.