Imagine asking a friend for some information on a webpage. The field should explain exactly what you need.
What You Need to Know
Password controls mask typed characters on screen, and autocomplete=current-password gives password managers a helpful hint.
Try the Example
Take a look at the example. We’ll explain the important lines right below it.
<form action="/login" method="post">
<label for="user-email">Email</label>
<input id="user-email" type="email" name="email" autocomplete="username" required>
<label for="user-password">Password</label>
<input id="user-password" type="password" name="password" autocomplete="current-password" required>
<button type="submit">Sign in</button>
</form>Let’s Read the Code
- autocomplete: Autocomplete tells browser autofill what kind of information belongs here.
- <form>: The form groups controls and identifies where submitted data goes.
- <label>: The label tells people what the input is for. A matching for/id pair makes the label clickable.
- for: For connects a label or output with a control by ID.
Read the named elements and attributes together. They explain how the browser connects this feature to the rest of the page.
What Happens in the Browser?
When the form reaches a server, the server must check the information again. A nice-looking HTML field is not a security control.
What about privacy? A password input hides characters from people looking over your shoulder, but it is not encryption. A real application uses HTTPS, secure server logic, and careful handling of any private information. Do not put passwords into GET query strings.
Your Turn
Replace current-password with new-password and explain when that would be appropriate.
Common Beginner Mistakes
- Using an autocomplete token as validation instead of a hint for browser autofill.
- Masking is not encryption. Always use HTTPS and verify credentials on the server.
Key Takeaways
- A control needs a clear label and, when submitted, a meaningful name and value.
- autocomplete: Autocomplete tells browser autofill what kind of information belongs here.
- Treat personal information carefully. The HTML example cannot replace HTTPS, server-side security checks, or safe storage.