Paste blocked in password or code field

auth/paste-blocked

WCAG success criterion: 3.3.8 (level AA)
Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Accessibility, Forms & Interaction
Default severity: high
axe-core rule: accessible-auth-paste-blocked

Why we flag this

Users can use neither a password manager nor the clipboard. Anyone who cannot memorise passwords or transcribe them accurately, for example because of cognitive or motor impairments, fails to sign in.

A synthetic paste event is cancelled and the probe text is not in the field afterwards (a paste handler calling preventDefault() or returning false); measured in same-origin frames and open shadow roots too.

What the rule checks

Scope. Rendered, enabled, editable password, current-password and one-time-code inputs in the document, open shadow roots and same-origin frames.

Expectation. Fails when the field blocks pasting: a synthetic, cancelable paste event (Rendering::paste_probe, measured by accessibility::probes in the running page) is cancelled and the pasted text does not arrive, so the secret must be typed from memory or transcribed instead of inserted by a password manager or the clipboard (F109). Blocking through an onpaste attribute, an event listener or with an alert is the same failure. A handler that cancels the native paste but inserts the (trimmed) text itself blocks nothing; readonly and disabled fields take no entry; hidden fields are not judged. Fields inside open shadow roots and same-origin frames are probed too (frame findings use the selector "{iframe} [frame] {field}"). Every blocked field is reported. A page whose scripts break the probe records the rule as not run (CapabilityMissing), never as a pass.

Source. WCAG 2.2 SC 3.3.8 Accessible Authentication (Minimum); failure F109 (preventing password or code re-entry in the same format)

Detection: shared; needs dom, interaction, geometry, frames.

Failing example

The check reports a violation here. Corpus case forms_signin_many. The page may contain further findings for other rules.

forms_signin_many.htmlHTML

<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Account switcher</title>
<style>
  body { font-family: sans-serif; color: #222; background: #fff; line-height: 1.5; margin: 0 16px; }
  a { color: #0050a0; }
  .skip, nav a, .solo { display: inline-block; padding: 12px; min-height: 44px; min-width: 44px; box-sizing: border-box; }
  button, input, select, textarea, [role="button"], [role="textbox"], [role="radio"], [role="link"], [role="searchbox"] {
    display: inline-block; min-height: 44px; min-width: 44px; box-sizing: border-box; font-size: 1rem; }
  input[type="checkbox"], input[type="radio"] { width: 44px; height: 44px; }
  .visually-hidden { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
</style>
</head>
<body>
<a class="skip" href="#main">Skip to main content</a>
<header><p>Example Shop</p>
<nav aria-label="Main"><a href="/" aria-current="page">Home</a> <a href="/help">Help</a></nav>
</header>
<main id="main">
<h1>Account switcher</h1>
<!-- G2 #783 threshold: six password fields that all block paste. Each is a 3.3.8 failure; all six are reported (the shared rule has no reporting cap). -->
<form action="/login/1" method="post"><p><label for="pw-many-1">Password for profile 1</label> <input id="pw-many-1" name="pw" type="password" autocomplete="current-password" onpaste="return false"></p><p><button type="submit">Sign in to profile 1</button></p></form>
<form action="/login/2" method="post"><p><label for="pw-many-2">Password for profile 2</label> <input id="pw-many-2" name="pw" type="password" autocomplete="current-password" onpaste="return false"></p><p><button type="submit">Sign in to profile 2</button></p></form>
<form action="/login/3" method="post"><p><label for="pw-many-3">Password for profile 3</label> <input id="pw-many-3" name="pw" type="password" autocomplete="current-password" onpaste="return false"></p><p><button type="submit">Sign in to profile 3</button></p></form>
<form action="/login/4" method="post"><p><label for="pw-many-4">Password for profile 4</label> <input id="pw-many-4" name="pw" type="password" autocomplete="current-password" onpaste="return false"></p><p><button type="submit">Sign in to profile 4</button></p></form>
<form action="/login/5" method="post"><p><label for="pw-many-5">Password for profile 5</label> <input id="pw-many-5" name="pw" type="password" autocomplete="current-password" onpaste="return false"></p><p><button type="submit">Sign in to profile 5</button></p></form>
<form action="/login/6" method="post"><p><label for="pw-many-6">Password for profile 6</label> <input id="pw-many-6" name="pw" type="password" autocomplete="current-password" onpaste="return false"></p><p><button type="submit">Sign in to profile 6</button></p></form>
</main>
<footer><p>Example Shop, 2026</p></footer>

</body>
</html>

Passing example

The check passes here and reports nothing. Corpus case forms_signin_embedded, element input#pw-shadow-ok. The page may contain further findings for other rules.

forms_signin_embedded.htmlHTML

<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Partner sign-in</title>
<style>
  body { font-family: sans-serif; color: #222; background: #fff; line-height: 1.5; margin: 0 16px; }
  a { color: #0050a0; }
  .skip, nav a, .solo { display: inline-block; padding: 12px; min-height: 44px; min-width: 44px; box-sizing: border-box; }
  button, input, select, textarea, [role="button"], [role="textbox"], [role="radio"], [role="link"], [role="searchbox"] {
    display: inline-block; min-height: 44px; min-width: 44px; box-sizing: border-box; font-size: 1rem; }
  input[type="checkbox"], input[type="radio"] { width: 44px; height: 44px; }
  .visually-hidden { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
</style>
</head>
<body>
<a class="skip" href="#main">Skip to main content</a>
<header><p>Example Shop</p>
<nav aria-label="Main"><a href="/" aria-current="page">Home</a> <a href="/help">Help</a></nav>
</header>
<main id="main">
<h1>Partner sign-in</h1>
<!-- G2 #783 frames and shadow DOM for 3.3.8: a password field that blocks paste inside a web component or a same-origin frame fails like one in the top document. -->
<div id="signin-widget"><template shadowrootmode="open"><style>input, button { min-height: 44px; min-width: 44px; }</style><form action="/login" method="post"><p><label for="pw-shadow">Password</label> <input id="pw-shadow" name="pw" type="password" autocomplete="current-password" onpaste="return false"></p><p><label for="pw-shadow-ok">Repeat password</label> <input id="pw-shadow-ok" name="pw2" type="password" autocomplete="current-password"></p><p><button type="submit">Sign in</button></p></form></template></div>
<iframe id="signin-frame" title="Partner sign-in form" width="100%" height="300" srcdoc="&lt;!doctype html&gt;&lt;html lang=&quot;en&quot;&gt;&lt;head&gt;&lt;meta charset=&quot;utf-8&quot;&gt;&lt;title&gt;Partner sign-in form&lt;/title&gt;&lt;style&gt;
  body { font-family: sans-serif; color: #222; background: #fff; line-height: 1.5; margin: 0 16px; }
  a { color: #0050a0; }
  .skip, nav a, .solo { display: inline-block; padding: 12px; min-height: 44px; min-width: 44px; box-sizing: border-box; }
  button, input, select, textarea, [role=&quot;button&quot;], [role=&quot;textbox&quot;], [role=&quot;radio&quot;], [role=&quot;link&quot;], [role=&quot;searchbox&quot;] {
    display: inline-block; min-height: 44px; min-width: 44px; box-sizing: border-box; font-size: 1rem; }
  input[type=&quot;checkbox&quot;], input[type=&quot;radio&quot;] { width: 44px; height: 44px; }
  .visually-hidden { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
&lt;/style&gt;&lt;/head&gt;&lt;body&gt;&lt;main&gt;&lt;form action=&quot;/login&quot; method=&quot;post&quot;&gt;&lt;p&gt;&lt;label for=&quot;pw-frame&quot;&gt;Password&lt;/label&gt; &lt;input id=&quot;pw-frame&quot; name=&quot;pw&quot; type=&quot;password&quot; autocomplete=&quot;current-password&quot; onpaste=&quot;return false&quot;&gt;&lt;/p&gt;&lt;p&gt;&lt;label for=&quot;pw-frame-ok&quot;&gt;Repeat password&lt;/label&gt; &lt;input id=&quot;pw-frame-ok&quot; name=&quot;pw2&quot; type=&quot;password&quot; autocomplete=&quot;current-password&quot;&gt;&lt;/p&gt;&lt;p&gt;&lt;button type=&quot;submit&quot;&gt;Sign in&lt;/button&gt;&lt;/p&gt;&lt;/form&gt;&lt;/main&gt;&lt;/body&gt;&lt;/html&gt;"></iframe>
</main>
<footer><p>Example Shop, 2026</p></footer>

</body>
</html>

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.