4

On most websites, you cannot copy from a password field. Also, on most websites, if you inspect the password field (Google Chrome), you can easily view the contents of the field in the code.

If we can just view the contents of the field in the code, why can't we also copy from these fields? Why do websites not allow this?

Improve this question
2
  • 7
    This gives a minor amount of extra security. Copying from a password field to notepad takes ~5 seconds and requires technical skills at the level of my 4 year old cousin. Inspecting page source requires ~20 seconds and the technical skill of my 12 year old cousin.
    – AstroDan
    Jan 24, 2017 at 21:35
  • Minor amounts of extra security is worth nothing.
    – Anders Lindén
    Apr 30, 2018 at 8:08

3 Answers 3

Reset to default
3

Form input fields of type password don't show the contents, or allow copying. My assumption is so that someone else cannot press 'back' after your logout and read the copy the content out on a shared computer.

Improve this answer
2
  • You can copy the contents by inspecting the text field in Google Chrome. The value attribute shows the password, uncensored
    – MCMastery
    Apr 30, 2018 at 22:33
  • Yes, modern browsers allow that. To the best of my memory the password field type existed many years before browsers had inspection tools.
    – Ed Neville
    May 7, 2018 at 10:23
2

Worse yet, if you copy it, the password is stored on your clipboard in a file that can be extracted and read later to recover such a password. Not that it matters at that point anyways, because Chrome probably saved it or they installed a keystroke logger to get you the next time you enter it.

Improve this answer
0

Browsers will often offer to save passwords, and autofill them into forms. Since most people don't protect their autofill with a password (or leave autofill unlocked), and additionally leave their computers unlocked (or even password-less), this exposes many passwords to an unsophisticated physical access attack in which the attacker copies the password out of the form field and into a non-obscured text field.

Having to inspect the page and dig through the html to find a password isn't particularly difficult for someone with some technical knowledge, but it narrows the field quite a bit from people who just know how to copy and paste. This makes it a small-downside wide-impact security filter.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .