- Success Criterion 3.3.8
- Conformance level AA
- W3C reference F109
Password Field That Blocks Pasting or Splits the Code Up
3.3.8 — Accessible Authentication (Minimum)
Scenario
Setting
A music streaming app's playlist screen
What’s wrong
The password or code field blocks pasting (or splits the code into boxes that break paste) — users are forced to memorize and retype, which is exactly what this rule forbids.
Example
<!-- Login requires solving an image CAPTCHA, no alternative -->Why it matters
People with cognitive disabilities and anyone who depends on password managers or paste.
How to test
Try to paste a password or verification code into the field: if paste is blocked, it fails.
How to fix
Allow paste and autofill in password/code fields — accept the code in one field.
<!-- Login uses email + password, or a passkey, with no puzzle/transcription step -->Authentication can't rely solely on solving a puzzle or transcription task with no cognitive-function-test alternative.
Outcome
On a music streaming app's playlist screen, this barrier is gone for people with cognitive disabilities and anyone who depends on password managers or paste — they get the same result as anyone else here.
Who is affected
People with cognitive disabilities and anyone who depends on password managers or paste.
Learn more
- Understanding Understanding document (opens in a new tab)
- Technique Related technique (opens in a new tab)
Related scenarios
- Password Field Scripted to Block Paste Entirely
- Password Manager Autofill Blocked by the Login Form
- Visual CAPTCHA Required With No Non-Visual Alternative
- Puzzle CAPTCHA Gating Login With No Alternative Method
- One-Time Code Split Into Boxes That Reject a Pasted Code
- Displayed Code Required to Be Retyped With Copying Disabled