Some web forms don't let the user paste text into password input fields.

For example I just noticed this on Apple's iTunes Connect website: https://itunesconnect.apple.com/

I don't see any advantages to it. Just reasons which speak against doing it. What is the reasoning behind it?

  • My initial thought is that perhaps it helps prevent automated entry via scripted viruses or the like. But even then, they could just manipulate the DOM directly, so that doesn't seem to make sense either.
    – DA01
    May 30 '13 at 17:55
  • 3
    @greenforest I think it's related, but not quite a duplicate. This is seeming to ask what reasons there would be for preventing pasting values into one particular field.
    – DA01
    May 30 '13 at 17:56
  • For a discussion on the security implications for this, see: Why do some sites block pasting into username or password input fields? on Security.StackExchange.
    – Simon East
    Nov 25 '15 at 23:04

Ignoring the Security concerns, keeping in mind that the password text is not visible (just asterisks/dots), a couple major UX reasons I can think of are:

  • Depending from where you are copying the password and where you are pasting it, you might end up with messed up clipboard entries (changing text from utf-8, html, richtext, docx, etc or something else).

  • Another common mistake will be copying empty spaces.

The outcome:

  • Frustrated user who cannot understand why his seemingly correct password is not working.
  • People thinking they were 'hacked' and their passwords changed.
  • In situations where only limited attempts are allowed, this can result in the account being locked.

There are ways of getting around this problem, like, letting the user toggle between a visible and obfuscated password text. But even that is not completely foolproof (Many input fields have padding which shows up as whitespace before the first character, an empty space can still be added there via copying. Similarly, spaces can also be added at the end if not careful.)

  • another example is frustrating copying from skype IM, which gives you '[11:16:56] .exp: pwd' instead of expected 'pwd'
    – exp
    May 31 '13 at 9:26
  • Ok, but I still I wouldn't disable pasting completely just because of these rather rare cases. I would rather listen to the "onpaste" event and then make the user aware of possible paste-related problems only after a failed login. May 31 '13 at 12:13
  • 3
    Try to login into an applicatoin with pasting disabled where you use a secure 25 chars random password you manage inside your password manager. The only way to login now is to paste the password somewhere else and then copy it manually. May 31 '13 at 12:21
  • @StefanNeubig Where do you read in my answer copying should be disabled? Anyways, updated the post regarding your second point.
    – rk.
    May 31 '13 at 12:28
  • @StefanNeubig Password managers have input functionality built it. So those don't necessarily count in copy-paste scenario.
    – rk.
    May 31 '13 at 12:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.