Password inputs must not block password managers

input-assistance/accessible-authentication · WCAG 3.3.8 · Level AA

Password inputs must not block password managers. Avoid autocomplete="off" and allow pasting.

WCAG 2.2 SC 3.3.8 requires that authentication steps either avoid cognitive function tests or provide a mechanism to assist users. Password managers are a key assistive mechanism. Setting autocomplete="off" on password fields prevents password managers from filling credentials. Blocking paste via onpaste attributes prevents users from pasting stored passwords. Set autocomplete to "current-password" for login forms or "new-password" for registration/change-password forms, and do not block paste on password fields.

Scan a page or repo for issues like this · All rules

Introduced in @accesslint/core v0.8.4