Is autocomplete="off" allowed on a login form?

It is valid HTML, but it removes the field's declared purpose, and browsers may disregard it on login fields. For accessibility, a login form should use username and current-password; a registration form should use new-password.

What is the difference between name and given-name?

name is the full name in one field. given-name, additional-name and family-name are its parts, for forms that ask for them separately. Use the one that matches what the field actually collects.

Does WCAG require autocomplete on every field?

No. Success criterion 1.3.5 applies to fields that collect information about the user and whose purpose is one of the listed input purposes. A search box or a comment field has no such purpose.

Reference

autocomplete attribute values

The HTML standard defines fifty-four autofill field names for the autocomplete attribute, from name and email to street-address, postal-code, tel, cc-number, bday and one-time-code. Each one tells the browser exactly what a field collects, so it can fill it from saved data and so assistive technology can present the field's purpose. The attribute can also hold on or off, a section- prefix, shipping or billing, and home, work, mobile, fax or pager before a contact field name.

The autofill field names defined by the HTML Standard (form control infrastructure, autofill), with the value format the standard expects and whether the VeriFixScan accessibility check infers that purpose from the field.
Field name	Meaning	Expected value	Inferred by the scan
name	Full name.	Free-form text, no newlines.	Yes: name, id or placeholder
honorific-prefix	Prefix or title (e.g. "Mr.", "Ms.", "Dr.", "Mlle").	Free-form text, no newlines.	No
given-name	Given name (in some Western cultures, also known as the first name).	Free-form text, no newlines.	Yes: name, id or placeholder
additional-name	Additional names (in some Western cultures, also known as middle names, forenames other than the first name).	Free-form text, no newlines.	No
family-name	Family name (in some Western cultures, also known as the last name or surname).	Free-form text, no newlines.	Yes: name, id or placeholder
honorific-suffix	Suffix (e.g. "Jr.", "B.Sc.", "MBASW", "II").	Free-form text, no newlines.	No
nickname	Nickname, screen name, handle: a typically short name used instead of the full name.	Free-form text, no newlines.	No
organization-title	Job title (e.g. "Software Engineer", "Senior Vice President", "Deputy Managing Director").	Free-form text, no newlines.	No
username	A username.	Free-form text, no newlines.	Yes: name, id or placeholder
new-password	A new password (e.g. when creating an account or changing a password).	Free-form text, no newlines.	No
current-password	The current password for the account identified by the username field (e.g. when logging in).	Free-form text, no newlines.	Yes: name, id, placeholder or type=password
one-time-code	One-time code used for verifying user identity.	Free-form text, no newlines.	No
organization	Company name corresponding to the person, address, or contact information in the other fields associated with this field.	Free-form text, no newlines.	Yes: name, id or placeholder
street-address	Street address (multiple lines, newlines preserved).	Free-form text.	Yes: name, id or placeholder
address-line1	Street address (one line per field).	Free-form text, no newlines.	No
address-line2	Street address, one line per field.	Free-form text, no newlines.	No
address-line3	Street address, one line per field.	Free-form text, no newlines.	No
address-level4	The most fine-grained administrative level, in addresses with four administrative levels.	Free-form text, no newlines.	No
address-level3	The third administrative level, in addresses with three or more administrative levels.	Free-form text, no newlines.	No
address-level2	The second administrative level, in addresses with two or more administrative levels; in the countries with two administrative levels, this would typically be the city, town, village, or other locality within which the relevant street address is found.	Free-form text, no newlines.	Yes: name, id or placeholder
address-level1	The broadest administrative level in the address, i.e. the province within which the locality is found; for example, in the US, this would be the state; in Switzerland it would be the canton; in the UK, the post town.	Free-form text, no newlines.	No
country	Country code.	Valid ISO 3166-1-alpha-2 country code.	No
country-name	Country name.	Free-form text, no newlines; derived from country in some cases.	Yes: name, id or placeholder
postal-code	Postal code, post code, ZIP code, CEDEX code (if CEDEX, append "CEDEX", and the arrondissement, if relevant, to the address-level2 field).	Free-form text, no newlines.	Yes: name, id or placeholder
cc-name	Full name as given on the payment instrument.	Free-form text, no newlines.	No
cc-given-name	Given name as given on the payment instrument (in some Western cultures, also known as the first name).	Free-form text, no newlines.	No
cc-additional-name	Additional names given on the payment instrument (in some Western cultures, also known as middle names, forenames other than the first name).	Free-form text, no newlines.	No
cc-family-name	Family name given on the payment instrument (in some Western cultures, also known as the last name or surname).	Free-form text, no newlines.	No
cc-number	Code identifying the payment instrument (e.g. the credit card number).	ASCII digits.	No
cc-exp	Expiration date of the payment instrument.	Valid month string.	No
cc-exp-month	Month component of the expiration date of the payment instrument.	Valid integer in the range 1..12.	No
cc-exp-year	Year component of the expiration date of the payment instrument.	Valid integer greater than zero.	No
cc-csc	Security code for the payment instrument (also known as the card security code (CSC), card validation code (CVC), card verification value (CVV), signature panel code (SPC), credit card ID (CCID), etc.).	ASCII digits.	No
cc-type	Type of payment instrument.	Free-form text, no newlines.	No
transaction-currency	The currency that the user would prefer the transaction to use.	ISO 4217 currency code.	No
transaction-amount	The amount that the user would like for the transaction (e.g. when entering a bid or sale price).	Valid floating-point number.	No
language	Preferred language.	Valid BCP 47 language tag.	No
bday	Birthday.	Valid date string.	No
bday-day	Day component of birthday.	Valid integer in the range 1..31.	No
bday-month	Month component of birthday.	Valid integer in the range 1..12.	No
bday-year	Year component of birthday.	Valid integer greater than zero.	No
sex	Gender identity (e.g. Female, Fa'afafine).	Free-form text, no newlines.	No
url	Home page or other web page corresponding to the company, person, address, or contact information in the other fields associated with this field.	Valid URL string.	No
photo	Photograph, icon, or other image corresponding to the company, person, address, or contact information in the other fields associated with this field.	Valid URL string.	No
tel	Full telephone number, including country code.	ASCII digits and U+0020 SPACE characters, prefixed by a U+002B PLUS SIGN character (+).	Yes: name, id, placeholder or type=tel
tel-country-code	Country code component of the telephone number.	ASCII digits prefixed by a U+002B PLUS SIGN character (+).	No
tel-national	Telephone number without the country code component, with a country-internal prefix applied if applicable.	ASCII digits and U+0020 SPACE characters.	No
tel-area-code	Area code component of the telephone number, with a country-internal prefix applied if applicable.	ASCII digits.	No
tel-local	Telephone number without the country code and area code components.	ASCII digits.	No
tel-local-prefix	First part of the component of the telephone number that follows the area code, when that component is split into two components.	ASCII digits.	No
tel-local-suffix	Second part of the component of the telephone number that follows the area code, when that component is split into two components.	ASCII digits.	No
tel-extension	Telephone number internal extension code.	ASCII digits.	No
email	Email address.	Valid email address.	Yes: name, id, placeholder or type=email
impp	URL representing an instant messaging protocol endpoint (for example, "aim:goim?screenname=example" or "xmpp:fred@example.net").	Valid URL string.	No

How the attribute value is built

The value is a list of tokens separated by spaces, and the last one is the field name from the table. Everything before it is optional and narrows the meaning.

A token starting with `section-` groups fields that belong together, so a page with two addresses does not mix them up. `shipping` or `billing` says which address or contact the field belongs to.

For the contact fields — `tel` and its parts, `email` and `impp` — a token `home`, `work`, `mobile`, `fax` or `pager` can come right before the field name: `autocomplete="work email"`.

`on` lets the browser offer whatever it guesses; `off` asks it not to autofill. Neither says what the field is, so neither helps a user or an assistive technology understand it.

`webauthn`, placed last, asks the browser to offer the public-key credentials — passkeys — it holds for the site when the user interacts with the field.

Why accessibility guidance points at this list

WCAG 2.2 success criterion 1.3.5, Identify Input Purpose, at level AA, requires that a field collecting information about the user has a purpose that can be determined programmatically when the purpose is one of the listed input purposes.

Those purposes are based on the autofill field names above, and the `autocomplete` attribute is the way HTML expresses them. A correct token lets the browser fill the field, and lets tools that adapt the page — replacing labels with symbols, for example — recognise what it asks for.

The criterion applies to fields about the person filling the form. A field asking for someone else's address, such as the recipient of a gift, is outside it, although a token still helps.

What a scan infers, and what it does not check

`accessibility.autocomplete` reads the form fields of the crawled pages. For each field it tries to infer a purpose: from `type="email"`, `type="tel"` or `type="password"` first, then from words in the field's name, id or placeholder such as email, phone, first name, surname, address, zip, city, country, company, password or username.

Only fields whose purpose it can infer are considered — the twelve marked in the table. A field among them with no `autocomplete` attribute, or with `autocomplete="off"`, is reported.

The check reports a missing or disabled attribute; it does not verify that the token present is the right one. A postal-code field marked `autocomplete="email"` passes it, and a field whose purpose cannot be inferred from its markup is not examined at all.

`mobile.forms` looks at the same fields from the phone's side: input types and tokens that give a touch keyboard the right layout and suggestions.

Frequently asked questions

Is autocomplete="off" allowed on a login form?: It is valid HTML, but it removes the field's declared purpose, and browsers may disregard it on login fields. For accessibility, a login form should use username and current-password; a registration form should use new-password.
What is the difference between name and given-name?: name is the full name in one field. given-name, additional-name and family-name are its parts, for forms that ask for them separately. Use the one that matches what the field actually collects.
Does WCAG require autocomplete on every field?: No. Success criterion 1.3.5 applies to fields that collect information about the user and whose purpose is one of the listed input purposes. A search box or a comment field has no such purpose.

Sources

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website