Authentication · Concept

Tell browsers what each identity field means.

Labels help people. Native types, names, and autocomplete tokens help browsers and password managers fill the same fields accurately.

Prerequisite form lessons

The principle

Use a visible label for the person and a correct autocomplete purpose for their browser.

Live examples

Current password and new password are different jobs.

Password managers depend on purpose. Sign-in asks for an existing credential; account creation asks the browser to generate or store a new one.

Sign in

Create account

Use at least 12 characters. Pasting is allowed.

Purpose tokens

Small attributes carry useful intent.

Keep stable, meaningful field names and standard autocomplete values. Do not invent values such as login-email that browsers do not recognize.

username

The identifier used to sign in, even when its HTML type is email.

current-password

An existing password used to authenticate this account.

new-password

A password being created or changed; password managers may offer generation.

Do not fight helpers

Allow paste and autofill.

Blocking paste, clearing autofilled values, or disabling autocomplete increases effort and interferes with password managers and assistive workflows.

Don’t block input helpers

These handlers and attributes make secure workflows harder.

<input type="password" autocomplete="off"
  onpaste="return false">

Do identify the field

Native semantics leave users free to type, paste, or use a manager.

<label for="password">Password</label>
<input id="password" name="password"
  type="password" autocomplete="current-password">

Quick test

Try more than typing.

  1. Confirm every field has a persistent visible label and stable name.
  2. Use username and current-password for sign-in.
  3. Use new-password when creating or changing a password.
  4. Paste into every identity and password field.
  5. Test browser and third-party password-manager autofill.
  6. Confirm required status, instructions, and errors remain available after autofill.