Honeypot autofill test

A honeypot field that browser autofill or a password manager fills in turns a real visitor into “spam”. This page lets you see it happen in your own browser, and check your own form.

Nothing on this page is sent anywhere. The form has no action, and everything runs in your browser.

1. Test your browser and password manager

Fill in the form below with autofill: click the name or email field and pick a saved profile, or use your password manager’s “fill identity”. Then look at the table: every hidden bait field that got a value would have blocked you.

Contact form

Hide bait fields with screen-reader-only CSS (clip) off-screen (left: -10000px) display: none Show bait fields

Name Email Phone

Message

Result

Waiting for autofill…

Hidden bait field	Status

Browsers only fill fields they recognise, and some skip fields that are not visible. Try each hiding method: results differ per browser and password manager.

2. Check your own form

Paste the HTML of a form, for example from your browser’s “View source” or “Copy outer HTML”. The checker finds fields that look like a honeypot and tells you whether autofill is likely to fill them in.

Form HTML

The checker compares names, ids, labels and placeholders with words that browser autofill and password managers commonly recognise. It can’t know every rule of every browser, so treat a clean result as “probably fine” and confirm it with the test above.

What to do about a risky field

• Give it a name and label that no autofill rule matches, such as referral_3f9a and “Leave this field empty”.
• Add autocomplete="off", data-1p-ignore, data-lpignore="true", data-bwignore and data-form-type="other".
• Show a visible error when a submission is blocked, instead of a blank page or a fake “thank you”.

Read why honeypots block real visitors, or use darvis/livewire-honeypot, which does all of this for Livewire and Laravel forms.