# An “input” element with a “type” attribute whose value is “hidden” must not have an “autocomplete” attribute whose value is “on” or “off”.

> Canonical HTML version: https://rocketvalidator.com/html-validation/an-input-element-with-a-type-attribute-whose-value-is-hidden-must-not-have-an-autocomplete-attribute-whose-value-is-on-or-off
> Attribution: Rocket Validator (https://rocketvalidator.com)
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

The `autocomplete` attribute tells the browser whether it can assist the user in filling out a form field, and if so, what type of data is expected. The generic values `"on"` and `"off"` control whether the browser should offer autofill suggestions to the user. Since `type="hidden"` inputs are never displayed and never receive direct user input, these values don't apply — there's no user interaction to assist with.

According to the HTML specification, hidden inputs *can* have an `autocomplete` attribute, but only with specific named autofill detail tokens (like `"transaction-id"` or `"cc-number"`). These tokens serve a programmatic purpose by providing hints about the semantic meaning of the hidden value, which can be useful for form processing. The generic `"on"` and `"off"` values, however, are explicitly disallowed because they only relate to the user-facing autofill behavior.

This validation error matters for standards compliance and can indicate a logical mistake in your markup. If you added `autocomplete="off"` to a hidden input hoping to prevent the browser from caching or modifying the value, it won't have that effect. Hidden input values are controlled entirely by the server or by JavaScript, not by browser autofill.

### How to fix it

1. **Remove the `autocomplete` attribute** if it's not needed — this is the most common fix.
2. **Use a specific autofill token** if you need to convey semantic meaning about the hidden value (e.g., `autocomplete="transaction-id"`).
3. **Reconsider the input type** — if the field genuinely needs autofill behavior controlled, it probably shouldn't be `type="hidden"`.

## Examples

### Incorrect: using `autocomplete="off"` on a hidden input

```html
<form action="/submit" method="post">
  <input type="hidden" name="token" value="abc123" autocomplete="off">
  <button type="submit">Submit</button>
</form>
```

### Incorrect: using `autocomplete="on"` on a hidden input

```html
<form action="/submit" method="post">
  <input type="hidden" name="session-id" value="xyz789" autocomplete="on">
  <button type="submit">Submit</button>
</form>
```

### Correct: removing the `autocomplete` attribute

```html
<form action="/submit" method="post">
  <input type="hidden" name="token" value="abc123">
  <button type="submit">Submit</button>
</form>
```

### Correct: using a specific autofill token

If the hidden input carries a value with a well-defined autofill semantic, you can use a named token:

```html
<form action="/checkout" method="post">
  <input type="hidden" name="txn" value="TXN-001" autocomplete="transaction-id">
  <button type="submit">Complete Purchase</button>
</form>
```

This is valid because `"transaction-id"` is a specific autofill detail token recognized by the specification, unlike the generic `"on"` or `"off"` values.