Never block paste in password or code fields
The password field refuses a paste, or the code arrives as six separate boxes, so a password manager cannot fill it and the user has to read the string and retype it. F109 is the failure technique for that, and a match is a defect rather than a security measure the rule respects. Two things stop it being a failure. Six boxes are fine where pasting the whole code into the first one fills the rest, which most current implementations already do. And the failure lifts entirely if the site offers another way in that does not test memory, such as a passkey or an emailed link. The clearest instance is the partial password, where a bank asks for the second, sixth and last characters. That cannot be pasted from anywhere and it is precisely the memory test this rule was written to stop. W3C files the failure under a Level AAA authentication rule as well.
How we find it in an audit
We try to paste. Into the password field, into the first box of a code group, into every credential input the flow puts up, and we watch whether the whole string lands. Where it does not, the next question is whether another way in exists that avoids the memory test, because that alternative clears the failure on its own. Partial-password prompts get flagged on sight. We also note credential fields with autocomplete switched off, which is not part of this technique and blocks a password manager just as effectively.
How affected users experience it
Copying a 24-character generated password by hand is a memory test, and stopping memory tests is the point of the rule. Someone with a working memory difference loses the string between the manager and the field, twice, then a third time. Screen-reader users get a harder version, because the password comes back as dots or as nothing, so there is no way to check the work and the only feedback is failure. Partial passwords are the worst of it. Counting to the sixth character of something you cannot see or hear is not authentication, it is an obstacle course.
Passes vs. fails
Passes
<input type="password" autocomplete="current-password">Fails
<input type="password" onpaste="return false" autocomplete="off">The other techniques filed under this rule
3 guides on this site are filed under 3.3.8 Accessible Authentication (Minimum). W3C documents this one as a failure of that rule, so it describes a way the rule gets broken rather than a way to pass it.
This guide is our interpretation of W3C technique F109: Failure of Success Criterion 3.3.8 and 3.3.9 due to preventing password or code re-entry in the same format. W3C publishes its techniques as guidance rather than as the standard, and says so on every one of them. The success criterion is what conformance is measured against, and a technique is one documented way to meet it.