ASVS V6.2.7 requires that pasting, browser password helpers and external password managers are permitted on password fields. It is a Level 1 requirement.
Why it matters
Blocking paste was once defended as a security measure. In practice it pushes people to short memorable passwords and reuse. Password managers generate long unique passwords, which is exactly what you want.
NIST guidance has recommended allowing paste for years, and the reason is practical. A strong password is hard to type from memory, and a manager is the only realistic way to keep one unique per site. Breaking paste breaks the best habit your users have.
How to implement it
Do nothing special, and remove anything that interferes. Use accurate autocomplete values so managers can recognize the fields.
<input type="password" name="password" autocomplete="current-password">
<input type="password" name="new-password" autocomplete="new-password">
Search your JavaScript for handlers on paste, copy, drop and contextmenu bound to these inputs, and delete them.
How to test it
Copy a long string, paste it into every password field, and confirm it appears. Use a password manager extension to fill and to save on each form, including the registration and change flows.
Run the test in at least two browsers and with one external manager. Autofill problems often appear in only one combination, usually after a front end redesign.
Common mistakes
-
onpaste="return false". -
Randomizing field names on every load, which breaks autofill.
-
Using
autocomplete="off"on the password field. -
Splitting the password across multiple inputs.
-
Disabling paste only on the confirm field. It still annoys people and adds no security.
Quick check
Does allowing paste weaken security?
No. It lets users use long random passwords from a manager, which strengthens security.
