SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-nist-allow-paste

Should a login page let you paste a password, according to NIST?

Yes. Paste should be allowed so password managers work.

Start playing free

  1. Block paste to stop malware
  2. Allow paste only for admins
  3. Allow paste so password managers work ✔

Why: Blocking paste makes people choose short passwords they can type. Pasting lets a password manager fill in a long random one. NIST says to permit it.

Huh, didn't know that: NIST also says to allow the use of password managers and autofill functionality.

The dad joke
Why did the password lack confidence? It was insecure.
Like this card?
Play the game

References

Answer: Allow paste so password managers work. Blocking paste makes people choose short passwords they can type. Pasting lets a password manager fill in a long random one. NIST says to permit it.

  1. NIST SP 800-63B Digital Identity Guidelines pages.nist.gov/800-63-4/sp800-63b.html
    permit claimants to use the "paste" function when entering a password
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat does current NIST guidance say about forcing symbols and capital letters in passwords?Security & PrivacyDoes NIST say companies should force staff to change passwords on a schedule?Security & PrivacyNIST says a password used as the only login factor should be at least how long?

That's stuff everyone should know.