password-paste-enabled
Authentication fields must not block pasting
Checks that a password or one-time-code field carries no inline paste handler that cancels the paste, which would take away the password manager or clipboard that spares users from remembering or retyping it.
Applies to. Applies to any control whose autocomplete token is current-password, new-password or one-time-code, and to <input type="password"> unless its autocomplete names another purpose. A disabled or readonly field takes no input to block, and one outside the accessibility tree is not being asked for, so neither is in scope. Finding nothing to ask about, it reports notApplicable, not pass: it applies only to what its check flags, and finding nothing there doesn't show that all is well.
Expectation. A reviewer confirms the field can still be pasted into. Remembering a password is a cognitive function test, and 3.3.8 asks for a mechanism that helps the user through one; a password manager, or the clipboard for a one-time code, is that mechanism.
What a finding reports.
handler: the field'sonpasteattribute value, with spacing collapsed. It only cancels the paste (PASTE_CANCELLED) or calls other script that may or may not (PASTE_HANDLER_OPAQUE).
These data.details fields help to read and reproduce a finding. Apart from reasonCode and the few fields Output schema names as stable, they are not a stable contract: a field may be renamed or dropped in a minor release, so don’t build on them.
Examples
<label for="p">Password</label><input type="password" id="p" onpaste="return false">
The inline handler cancels paste outright, blocking a password manager or a copied one-time code.
<label for="p">Password</label><input type="password" id="p" autocomplete="current-password">
No paste handler is attached at all.
How to check
When this rule can’t decide, it reports cantTell and leaves the question to a person. Each question it can ask is listed here under its reason code, with the steps to answer it. A finding carries the same steps as howToCheck, in the scan’s language. See Output schema.
PASTE_CANCELLED
- Copy a test password or code to the clipboard.
- Click in the field the report names and paste (Ctrl+V or Cmd+V, or the context menu).
- If the field is split into boxes for a one-time code, check whether the digits spread across them.
- Also try filling the field with the browser's password manager.
- If both are blocked, check whether the same sign-in step offers another way to log in that needs no remembering or typing, such as a passkey or a link sent by email. It only counts if it works and you can use it with the keyboard.
Pass. The pasted or autofilled value appears in the field, or the same step offers a working way to log in that needs no remembering or typing.
Fail. Paste and password-manager filling are blocked and no other way to log in is offered, so the user must remember and type the value, which fails WCAG 3.3.8.
PASTE_HANDLER_OPAQUE
- Copy a test password or code to the clipboard.
- Click in the field the report names and paste (Ctrl+V or Cmd+V, or the context menu).
- Check the whole value arrives in the field (for split code boxes, across the boxes), and that no message says pasting is not allowed.
- Also try filling the field with the browser's password manager.
- If both are blocked, check whether the same sign-in step offers another way to log in that needs no remembering or typing, such as a passkey or a link sent by email. It only counts if it works and you can use it with the keyboard.
Pass. The pasted or autofilled value appears in full in the field, or the same step offers a working way to log in that needs no remembering or typing.
Fail. Pasting or autofill is blocked or the value is cut or cleared, and no other way to log in is offered, so the user must type it from memory, which fails WCAG 3.3.8.