HTML Guides for autofill

The autocomplete attribute isn't a true/false switch: to turn autofill off on a <textarea>, write autocomplete="off", not autocomplete="false".

On a <textarea>, as on <input> and <select>, autocomplete takes either on or off, or autofill field names such as street-address that tell the browser what data the field expects. true and false belong to other attributes, like spellcheck and contenteditable, and the validator rejects autocomplete="true" too.

An invalid value doesn't fail safe. The HTML standard treats a value it can't parse as if the attribute weren't there, so the <textarea> falls back to its form's autocomplete setting. Unless the form says off, autofill stays on, which is the opposite of what false was meant to do.

With autocomplete="off", the browser should not save what the user types in the field or suggest values typed before. Browsers treat it as a request. The standard lets them allow users to override it, and most browsers ignore off on login fields so password managers keep working. On an ordinary message field, removing the attribute is also a valid fix.

If the goal was to stop the red underlines or the automatic corrections, those have their own attributes. spellcheck="false" turns off spelling and grammar checking, and autocorrect="off" tells the browser not to correct words as the user types. Watch the values: spellcheck takes true and false, but autocorrect takes on and off like autocomplete, so autocorrect="false" is also an error.

Invalid example

<form action="/contact" method="post">

<label for="message">Message</label>

<textarea id="message" name="message" rows="6" autocomplete="false"></textarea>

<button type="submit">Send</button>

</form>

Valid example

<form action="/contact" method="post">

<label for="message">Message</label>

<textarea id="message" name="message" rows="6" autocomplete="off"></textarea>

<button type="submit">Send</button>

</form>

To turn off spell checking and autocorrection instead:

<label for="snippet">Code snippet</label>

<textarea id="snippet" name="snippet" rows="6" spellcheck="false" autocorrect="off"></textarea>

The autocomplete attribute tells the browser how to handle autofilling a form field. The HTML specification defines a strict set of allowed values: the keywords on and off, and a collection of autofill field names such as name, email, username, new-password, street-address, and many others. The value "none" is not part of this specification, even though it might seem like a logical choice for "no autocomplete."

This confusion likely arises because some non-web APIs and frameworks use "none" as a keyword to disable features. In HTML, however, the correct keyword to disable autocompletion is "off". Using an invalid value like "none" leads to undefined browser behavior — some browsers may ignore it entirely and autofill anyway, while others might treat it as equivalent to "on". This inconsistency can cause unexpected user experiences and potential security concerns, especially for sensitive fields like passwords or credit card numbers.

Beyond standards compliance, using valid autocomplete values improves accessibility. Assistive technologies and password managers rely on recognized autofill field names to help users fill out forms efficiently. When a valid, descriptive value like "username" or "email" is provided, browsers and assistive tools can offer more accurate suggestions.

How to fix it

Replace "none" with the appropriate valid value:

• Use "off" if you want to disable autofill for the field.
• Use "on" if you want the browser to decide how to autofill the field.
• Use a specific autofill field name if you want to hint at the type of data expected.

Common autofill field names include: name, given-name, family-name, email, username, new-password, current-password, tel, street-address, postal-code, country, cc-number, cc-exp, and cc-name. You can also combine tokens, such as "shipping postal-code" or "billing cc-number", to provide additional context through section and hint tokens.

Note: Even with autocomplete="off", some browsers may still autofill certain fields (particularly login credentials) for security or usability reasons. This is browser-specific behavior and not something the HTML specification can override.

Examples

Incorrect: using "none" to disable autofill

<form>

<label for="user">Username</label>

<input type="text" id="user" name="username" autocomplete="none">

</form>

Correct: using "off" to disable autofill

<form>

<label for="user">Username</label>

<input type="text" id="user" name="username" autocomplete="off">

</form>

Correct: using a specific autofill field name

When you know what kind of data a field collects, providing a descriptive autofill field name is often better than using "on" or "off". This helps browsers offer accurate suggestions:

<form>

<label for="user">Username</label>

<input type="text" id="user" name="username" autocomplete="username">

<label for="email">Email</label>

<input type="email" id="email" name="email" autocomplete="email">

<label for="pwd">New Password</label>

<input type="password" id="pwd" name="password" autocomplete="new-password">

</form>

Correct: using section and hint tokens

You can prefix an autofill field name with a section name or shipping/billing hint to distinguish between multiple addresses in the same form:

<form>

<label for="ship-zip">Shipping postal code</label>

<input type="text" id="ship-zip" name="ship_zip" autocomplete="shipping postal-code">

<label for="bill-zip">Billing postal code</label>

<input type="text" id="bill-zip" name="bill_zip" autocomplete="billing postal-code">

</form>

The autocomplete attribute holds a word that isn't one of the autofill field names defined in the HTML standard.

autocomplete tells browsers and password managers what saved data can fill a form control. Its value is either on or off on its own, or a token from a fixed list, such as name, email, tel, organization, postal-code or country. The token can be preceded by a section-* name and by shipping or billing, as in section-work shipping postal-code. The tokens are English words whatever the language of the page, and letter case doesn't matter. Browsers ignore any other value. The control then behaves as if it had no autocomplete attribute and follows its form's setting, which is on by default.

The validator reads the value word by word and quotes the first word it can't place, in lower case. So autocomplete="Choose a topic" is reported as the string "choose", and autocomplete="shipping clinic-name" as "clinic-name". on and off must stand alone: autocomplete="off email" is reported as the string "off".

If a standard token describes the control, use it. If none does, set autocomplete="off" or remove the attribute, and keep your own identifier in name or id. The usual cause depends on the element:

• <input>: the field's own name ends up in the attribute, like company, telephone or a word in the page's language. Look for the token that means the same thing: organization for a company name, tel for a phone number. The token also has to suit the input's type, or the validator reports that it isn't allowed in this context. Invented values like nope, none or nothanks are also common, added to stop the browser from offering saved data. Write off instead. On a field where the user picks a new password, new-password tells the browser not to fill in a saved password.
• <textarea>: the value is usually message, comments or a misspelling of one of them. Spelling it right doesn't help, because the list has no token for text the user writes freely. Use off or remove the attribute. A <textarea> that collects a postal address over several lines can take street-address.
• <select>: several tokens fit a dropdown, such as country, bday-month, bday-year, cc-exp-month and sex. The bad value is often text meant for people, like the field's label or its "Choose an option" prompt, sometimes copied into the attribute by a form builder. For a list the browser keeps no data for, such as topics or departments, remove the attribute.

Invalid example

<form action="/contact" method="post">

<label for="clinic">Clinic</label>

<input type="text" id="clinic" name="clinic" autocomplete="clinic-name">

<label for="topic">Topic</label>

<select id="topic" name="topic" autocomplete="Choose a topic">

<option value="">Choose a topic</option>

<option value="billing">Billing</option>

<option value="support">Support</option>

</select>

<label for="message">Message</label>

<textarea id="message" name="message" rows="6" autocomplete="message"></textarea>

<button type="submit">Send</button>

</form>

Valid example

<form action="/contact" method="post">

<label for="clinic">Clinic</label>

<input type="text" id="clinic" name="clinic" autocomplete="off">

<label for="topic">Topic</label>

<select id="topic" name="topic">

<option value="">Choose a topic</option>

<option value="billing">Billing</option>

<option value="support">Support</option>

</select>

<label for="message">Message</label>

<textarea id="message" name="message" rows="6" autocomplete="off"></textarea>

<button type="submit">Send</button>

</form>

When a standard token fits the control, use it:

<form action="/checkout" method="post">

<label for="company">Company</label>

<input type="text" id="company" name="company" autocomplete="organization">

<label for="country">Country</label>

<select id="country" name="country" autocomplete="shipping country">

<option value="ES">Spain</option>

<option value="FR">France</option>

</select>

<label for="address">Delivery address</label>

<textarea id="address" name="address" rows="3" autocomplete="shipping street-address"></textarea>

<button type="submit">Continue</button>

</form>