• Success Criterion 3.3.8
  • Conformance level AA

One-Time Code Split Into Boxes That Reject a Pasted Code

3.3.8 — Accessible Authentication (Minimum)

Scenario

Setting

A photo-sharing app's upload screen

What’s wrong

one-time password (OTP) split into 6 single-character inputs that reject paste of the full code.

Example 

<input maxlength="1" class="otp-box">
<input maxlength="1" class="otp-box">
<input maxlength="1" class="otp-box">
<!-- pasting a 6-digit code into any box is ignored; each box accepts only one manually typed digit -->

Why it matters

A user copying a one-time code from their messaging app before uploading photos finds pasting does nothing, so they must type all six digits from memory before the code expires.

How to test

Copy a one-time code and try to paste it into a split multi-box OTP input: if pasting the full code doesn't work and each box must be typed individually, it fails.

How to fix

Make every box in a split-code input accept a full pasted code and distribute it automatically, or use one plain input instead.

<input class="otp-box" maxlength="1" onpaste="distributeDigits(event)">
<!-- distributeDigits splits a pasted 6-digit string across all six boxes -->

Outcome

The user pastes the six-digit code in one action and uploads their photos before the code times out.

Who is affected

People with cognitive and motor disabilities who rely on copy-paste rather than manually retyping a short-lived numeric code.

Learn more

Related scenarios