autocomplete attribute

WCAG includes a success criterion requiring the purpose of input fields collecting information about the user to be programmatically determinable.

The attribute's fixed vocabulary is how that purpose is expressed, so the criterion is satisfied by using it correctly.

It also lets assistive tooling present a field in a way adapted to the person — including with symbols rather than text for some users.

And it reduces typing, which is the whole interaction for someone using a switch device or voice input.

Which is why it is reported alongside labels rather than alongside performance.

It is most often applied to login and payment fields in the belief it improves security.

Browsers largely ignore it on password fields precisely because that reasoning produced worse outcomes: people reuse passwords when a manager cannot fill them.

On address and payment fields it does work, and the result is more typing, more errors and more abandonment.

The legitimate uses are narrow — a field whose value should genuinely never be remembered, such as a one-time code, which has its own vocabulary value instead.

The vocabulary is fixed. An invented value is ignored entirely, so a plausible-looking guess does nothing.

Multi-part values exist for addresses and names, and using the granular values is what lets a browser fill several fields from one stored record.

A section token allows two addresses on one form — a billing and a shipping — to be filled independently.

The one-time code value is what makes a verification code fill from a message automatically, which is a measurable improvement in completion.

Name attributes matching common conventions help as a fallback, and they are a heuristic rather than a declaration.

It does not validate anything. A field declared as a postal code accepts whatever is typed into it.

It does not change the field's type, so an appropriate input type is still needed for the right keyboard on a phone.

It does not label the field: a filled field with no accessible name is still unannounced.

So it sits alongside the label, the type and the validation rather than substituting for any of them.

Fields collecting information about the person are checked for the attribute and for whether its value is in the fixed vocabulary.

Fields are checked separately for an accessible name, since the two requirements are independent.

Error handling on the form is read alongside, because a field that fills correctly and reports errors poorly is still hard to complete.

Whether the declared purpose matches what the field really collects is inferred from context and is an indication rather than a certainty.