# Password, secret, token

**Test family:** `PWD`

This file is self-contained. Adapt lengths and accepted characters from the full product path, not only the HTML attributes.

- **PWD-001** Empty/missing password fails generically without disclosing account state.
- **PWD-002** Accept long passphrases and full intended character set; do not silently trim, normalize, or truncate.
- **PWD-003** Verify spaces at start/end and pasted values follow the stated policy; reveal policy before failure.
- **PWD-004** Show/hide toggles preserve value, caret, focus, accessible state, and do not expose it after navigation.
- **PWD-005** Use password-manager-compatible labels and autocomplete values for current/new password.
- **PWD-006** Never place secrets in URL, analytics, console, DOM outside the control, logs, screenshots, clipboard unexpectedly, or error copy.
- **PWD-007** Reject known-compromised or weak passwords if promised without blocking reasonable passphrases via arbitrary composition rules.
- **PWD-008** New/confirm fields compare exact intended strings and identify which field needs correction.
- **PWD-009** Change/reset invalidates the intended sessions/tokens, preserves unrelated account data, and sends truthful alerts.
- **PWD-010** Rate limiting, lockout, and recovery resist guessing without enabling trivial account denial-of-service.
- **PWD-011** Browser back, page source, form repopulation, crash restore, and cached responses do not reveal the secret.
- **PWD-012** Server stores a slow salted password hash and compares without exposing distinct timing or error details.

## Comprehensive per-item coverage

- **PWD-013** Enter ordinary lowercase, uppercase, mixed-case, numeric, and alphanumeric values; apply the documented character policy consistently.
- **PWD-014** Enter ASCII emoticons such as `:)`, `:-)`, `;)`, `:D`, `:(`, and `<3`; accept or reject each deliberately without corruption, partial stripping, or a server error.
- **PWD-015** Enter kaomoji and symbol-heavy emoticons such as `¯\_(ツ)_/¯`, `(╯°□°)╯︵ ┻━┻`, and `ಠ_ಠ`; preserve or reject the whole value predictably.
- **PWD-016** Enter a single emoji, repeated emoji, skin-tone modifier, variation selector, keycap, flag, and ZWJ family/profession sequence; count and validate complete grapheme clusters.
- **PWD-017** Mix letters, digits, punctuation, emoticons, and emoji in one value; never normalize it into a different accepted identity or meaning.
- **PWD-018** Try ASCII control characters, tab, newline, carriage return, null, non-breaking space, word joiner, and zero-width characters through UI and direct requests.
- **PWD-019** Try Latin accents, decomposed accents, CJK, Arabic, Hebrew, Devanagari, and mixed-script text; preserve supported scripts and explain unsupported ones.
- **PWD-020** Try left-to-right, right-to-left, and bidi-override/isolate characters; keep value, cursor, error, surrounding label, logs, and exports unambiguous.
- **PWD-021** Compare visually confusable values using Latin, Cyrillic, Greek, digits, homoglyph punctuation, and normalization equivalents; prevent unintended duplicates or spoofing.
- **PWD-022** Exercise exact lower and upper boundaries using ASCII, two-byte characters, four-byte emoji, and multi-code-point graphemes; enforce the declared counting unit everywhere.
- **PWD-023** Send the same value through form encoding, JSON, multipart, URL query/path, API, import, and mobile/native clients where applicable; decode exactly once.
- **PWD-024** Use inert SQL, markup, script, template, command, path, CSV-formula, and log-forging canaries; keep them data in validation, storage, display, notifications, analytics, and export.
- **PWD-025** Type slowly and rapidly, paste plain/rich text, drag text, use autofill, dictate, compose with an IME, undo/redo, and replace a selection; converge on the same value.
- **PWD-026** Bypass `maxlength`, `pattern`, `required`, input type, disabled, and client validation; require the authoritative server contract and a useful error.
- **PWD-027** Save, reload, navigate back/forward, reopen, search, sort, mention, notify, audit, sync, import, and export the value; preserve intended content and policy.
- **PWD-028** Edit the same value concurrently from two sessions and retry after timeout; detect conflicts and avoid duplicate side effects or silent overwrites.
- **PWD-029** Exercise offline, validation timeout, save failure, partial response, reconnect, and session expiry; retain recoverable input and never claim false success.
- **PWD-030** Verify label, instructions, required state, error, suggestions, character count, focus, and current value with keyboard, switch, voice, and screen-reader use.
- **PWD-031** Test narrow viewport, zoom/reflow, large fonts, high contrast, reduced motion, translated copy, locale-specific input, and mobile keyboards without hiding or altering the value.
- **PWD-032** Measure validation and save behavior near maximum size and during rapid input; avoid UI freezes, request storms, timing leaks, and unbounded downstream work.
- **PWD-033** Inspect DOM, URL, clipboard, browser storage, telemetry, logs, traces, crash reports, notifications, and screenshots; expose the value only according to its data classification.
- **PWD-034** Delete, clear, reset, cancel, and restore the value; distinguish intentional removal from lost input and honor retention, audit, and recovery policy.

[Back to Input controls index](../../controls-input.md)
