User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Some web forms don't let the user paste text into password input fields.

For example I just noticed this on Apple's iTunes Connect website:

I don't see any advantages to it. Just reasons which speak against doing it. What is the reasoning behind it?

share|improve this question

marked as duplicate by greenforest, Graham Herrli, Ben Brocka May 31 '13 at 13:03

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

My initial thought is that perhaps it helps prevent automated entry via scripted viruses or the like. But even then, they could just manipulate the DOM directly, so that doesn't seem to make sense either. – DA01 May 30 '13 at 17:55
@greenforest I think it's related, but not quite a duplicate. This is seeming to ask what reasons there would be for preventing pasting values into one particular field. – DA01 May 30 '13 at 17:56
For a discussion on the security implications for this, see: Why do some sites block pasting into username or password input fields? on Security.StackExchange. – Simon East Nov 25 '15 at 23:04
up vote 5 down vote accepted

Ignoring the Security concerns, keeping in mind that the password text is not visible (just asterisks/dots), a couple major UX reasons I can think of are:

  • Depending from where you are copying the password and where you are pasting it, you might end up with messed up clipboard entries (changing text from utf-8, html, richtext, docx, etc or something else).

  • Another common mistake will be copying empty spaces.

The outcome:

  • Frustrated user who cannot understand why his seemingly correct password is not working.
  • People thinking they were 'hacked' and their passwords changed.
  • In situations where only limited attempts are allowed, this can result in the account being locked.

There are ways of getting around this problem, like, letting the user toggle between a visible and obfuscated password text. But even that is not completely foolproof (Many input fields have padding which shows up as whitespace before the first character, an empty space can still be added there via copying. Similarly, spaces can also be added at the end if not careful.)

share|improve this answer
another example is frustrating copying from skype IM, which gives you '[11:16:56] .exp: pwd' instead of expected 'pwd' – exp May 31 '13 at 9:26
Ok, but I still I wouldn't disable pasting completely just because of these rather rare cases. I would rather listen to the "onpaste" event and then make the user aware of possible paste-related problems only after a failed login. – Stefan Neubig May 31 '13 at 12:13
Try to login into an applicatoin with pasting disabled where you use a secure 25 chars random password you manage inside your password manager. The only way to login now is to paste the password somewhere else and then copy it manually. – Stefan Neubig May 31 '13 at 12:21
@StefanNeubig Where do you read in my answer copying should be disabled? Anyways, updated the post regarding your second point. – rk. May 31 '13 at 12:28
@StefanNeubig Password managers have input functionality built it. So those don't necessarily count in copy-paste scenario. – rk. May 31 '13 at 12:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.