html/password-autocomplete

Why

Password managers decide from autocomplete whether to fill a saved password or offer a new strong one. Without the token they guess, often wrongly (filling the old password into "new password"); autocomplete="off" tries to stop them altogether. People who rely on a manager instead of memory then cannot sign in easily, which is what WCAG 3.3.8 is about.

Fix

Use autocomplete="current-password" on sign-in and on the "current password" field of a change form, autocomplete="new-password" on sign-up and on the new password fields, and autocomplete="username" on the account field next to them. Allow paste.

Examples

<!-- bad -->
<input id="pw" name="password" type="password" autocomplete="off">
<!-- good -->
<input id="pw" name="password" type="password" autocomplete="current-password">

Sources

• HTML Standard, Autofill (autofill field names)
• web.dev, Sign-in form best practices
• WCAG 2.2, Understanding SC 3.3.8 Accessible Authentication (Minimum)

Read it in the terminal

npx github:dawidolko/frontend-skills explain html/password-autocomplete