password-paste-enabled

Authentication fields must not block pasting

Checks that a password or one-time-code field carries no inline paste handler that cancels the paste, which would remove the password manager or clipboard that WCAG 3.3.8 relies on as the assisting mechanism.

Applies to. Applies to any control whose autocomplete token is current-password, new-password or one-time-code, and to <input type="password"> unless its autocomplete names another purpose. A disabled or readonly field takes no input to block, and one outside the accessibility tree is not being asked for, so neither is in scope.

Expectation. A reviewer confirms the field can still be pasted into. Remembering a password is a cognitive function test, and 3.3.8 asks for a mechanism that helps the user through one; a password manager, or the clipboard for a one-time code, is that mechanism.

Examples

<label for="p">Password</label>
<input type="password" id="p" onpaste="return false">

<label for="p">Password</label>
<input type="password" id="p" autocomplete="current-password">

View source