Imagine asking a friend for some information on a webpage. The field should explain exactly what you need.
What You Need to Know
Both fields are marked as new passwords for password managers. Matching the values needs JavaScript or server validation.
Try the Example
Take a look at the example. We’ll explain the important lines right below it.
<form action="/register" method="post">
<label for="password">New password</label>
<input id="password" name="password" type="password" autocomplete="new-password" required>
<label for="confirm-password">Confirm new password</label>
<input id="confirm-password" name="confirm-password" type="password" autocomplete="new-password" required>
<button type="submit">Create account</button>
</form>Let’s Read the Code
- <form>: The form groups controls and identifies where submitted data goes.
- <label>: The label tells people what the input is for. A matching for/id pair makes the label clickable.
- for: For connects a label or output with a control by ID.
- id: An id uniquely identifies an element on this page.
Read the named elements and attributes together. They explain how the browser connects this feature to the rest of the page.
What Happens in the Browser?
When the form reaches a server, the server must check the information again. A nice-looking HTML field is not a security control.
What about privacy? A password input hides characters from people looking over your shoulder, but it is not encryption. A real application uses HTTPS, secure server logic, and careful handling of any private information. Do not put passwords into GET query strings.
Your Turn
Type different passwords and explain why the browser might still allow submission.
Common Beginner Mistakes
- Copying the example without giving the fields a clear label and a usable name.
- Two required fields do not automatically check whether passwords match.
Key Takeaways
- A control needs a clear label and, when submitted, a meaningful name and value.
- <form>: The form groups controls and identifies where submitted data goes.
- Treat personal information carefully. The HTML example cannot replace HTTPS, server-side security checks, or safe storage.