Password input hides typed characters on screen, but the value is still part of the form submission and can be inspected by the application receiving it. We will keep the example small, so you can see how the fields work without building a whole application first.
What You Need to Know
Always submit credentials to a properly secured HTTPS endpoint with POST. Autocomplete tokens such as current-password help password managers understand the field.
Example: See It in Action
Add this example to the appropriate part of a practice HTML page. Read each line before you open the page in your browser.
This is a short HTML fragment. To try it as a webpage, put it inside the body element of a complete HTML document.
<form action="/login" method="post">
<label for="password">Password</label>
<input type="password" id="password" name="password" autocomplete="current-password" required>
<button type="submit">Sign in</button>
</form>Let’s Understand the Example
- Input creates a form control. Its type decides whether people type text, choose a date, move a slider and more.
- Label tells people what a control is for. For connects the label to the control with the matching id.
- Type changes the kind of input, script, resource or button, depending on the element.
- Action names the destination where the browser sends a form submission. A real server handler must exist there.
- Method controls how a form submits; GET makes values part of the URL, while POST sends them in the request body.
- For links a label to the input whose id matches, so clicking the label can focus the control.
The browser can submit values with keys such as password. A control without a name normally contributes no entry. Whether the submission produces a result depends on the action URL and the server behind it.
What Should You See?
You should see controls for Password. The example uses an input of type password and sends a POST request when submitted. If the action points to a missing server endpoint, the browser cannot complete the task.
Choose one field and predict its submitted name and value. Then change the value and check whether the browser accepts it. Do not assume that a working-looking form has a real server behind it.
Try It Yourself
- Add a username field and ensure both controls have useful autocomplete values.
- Save your changes, open or refresh the page, and compare the result with the original example.
- Tell a friend what your change did. If you are not sure, undo it, refresh the page, and compare.
Common Beginner Mistakes
- Believing masked dots mean the password is encrypted or safe to put in a GET URL.
- Client-side HTML validation is a helpful first check, not a security boundary. A real receiving application must validate the values again.
Key Takeaways
- Password input hides typed characters on screen, but the value is still part of the form submission and can be inspected by the application receiving it.
- Input creates a form control. Its type decides whether people type text, choose a date, move a slider and more.
- Always submit credentials to a properly secured HTTPS endpoint with POST. Autocomplete tokens such as current-password help password managers understand the field.