• Success Criterion 3.3.8
  • Conformance level AA
  • W3C reference F109

Password Field That Blocks Pasting or Splits the Code Up

3.3.8 — Accessible Authentication (Minimum)

Scenario

Setting

A music streaming app's playlist screen

What’s wrong

The password or code field blocks pasting (or splits the code into boxes that break paste) — users are forced to memorize and retype, which is exactly what this rule forbids.

Example 

<input type="password" id="playlist-pin" onpaste="return false">
<!-- sharing a private playlist requires a 4-digit PIN the owner sent, but pasting it in is blocked -->

Why it matters

A friend sent the PIN in a text message, but the field forces them to memorize and retype four digits instead of pasting what they already have.

How to test

Try to paste a password or verification code into the field: if paste is blocked, it fails.

How to fix

Never block paste on an authentication field. Letting people paste a code is exactly what removes the cognitive test.

<input type="password" id="playlist-pin">
<!-- no onpaste handler, so paste works normally -->

Outcome

The friend pastes the PIN from their messages and opens the shared playlist immediately.

Who is affected

People with cognitive and memory disabilities, and screen reader or switch-access users who rely on paste and password managers to enter codes.

Learn more

Related scenarios