HTML cc-csc Autocomplete Token: Reference and Examples

Have you ever started typing into a form and had your browser suggest a saved value? HTML can help the browser decide which value belongs in which field. The autocomplete token cc-csc is used for card security code or verification value.

What cc-csc tells the browser

Card security code or verification value.

This is a hint, not an instruction to fill a value automatically. Browsers and password managers consider settings, saved data, permissions and other signals before offering suggestions.

Example form field

<form action="/example" method="post">
    <label for="detail-field">Security code</label>
    <input id="detail-field" name="detail" type="text" autocomplete="cc-csc" inputmode="numeric">
    <button type="submit">Continue</button>
</form>

Understanding the example

The autocomplete="cc-csc" attribute labels this field for autofill. Its visible <label> still tells people what to type, and its name attribute determines the key sent when a form is submitted.

Treat as highly sensitive; never log or store the security code after authorization.

Sensitive information deserves extra care. Use HTTPS, collect only what is needed, avoid logging secrets, and validate received data on the server. Payment card fields should generally use a compliant payment provider rather than custom storage.

Try it yourself

Save the example as an HTML file, and test the field with browser autofill enabled. Inspect the autocomplete value and compare it with the field label. Browser behavior depends on available saved information, so a missing suggestion is not necessarily an HTML mistake.

Common Beginner Mistakes

Treat as highly sensitive; never log or store the security code after authorization.
Leaving out the visible label because the browser might autofill the field.
Treating autofill suggestions as verified or safe data.

Key Takeaways

cc-csc describes card security code or verification value.
Treat as highly sensitive; never log or store the security code after authorization.
Autocomplete helps users; it does not replace labeling, accessibility or validation.