I've noticed some sites will prevent users from pasting data - anything from passwords to usernames/emails to everything. Without discussing the practice and rational/reasons for/against it, what is the technical means by which a website prevents me from pasting data into a text entry field?

For example, this site does not allow pasting into the "Retype Email Address" field. How? It's my guess that there are various ways to implement this behavior?

I'm using Firefox 62.0.2 on OS X 10.11.6.

  • As an aside: It's annoying. I wrote a trivial script in AutoKey (Desktop Automation for Linux, but there are similar utilities for Windows and Mac) that just types the contents of the clipboard. That gets past most, but not all such websites. Random passwords are great for security, but terrible to type. – Joe Oct 9 '18 at 5:03

Answer: JavaScript

Look at the source code of the page you link to.

<input type="text" size="30" maxlength="99" onkeydown="clearErrMsg(event)" onblur="validateEmail(false)" onpaste="SFDOMEvent.preventDefault(event);"
               value="" aria-required="true">

It has SFDOMEvent.preventDefault(event); bound to the onpaste event of the input element. preventDefault will abort the action being taken by preventing the default behaviour - the paste. Other sites will use variations of this.


It is very simple to disable copy, cut or paste into an HTML field :

Example that disables everything :

<input type="text" onselectstart="return false" onpaste="return false;" onCopy="return false" onCut="return false" onDrag="return false" onDrop="return false" autocomplete=off/>

For more information see Prevent Copy, Cut and Paste into HTML Input Text Fields.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.