> ## Content Index
> Fetch the complete content index at: https://developerinsider.co/llms.txt
> Use this file to discover other available public pages before exploring further.

# iOS12 - Password AutoFill, Automatic Strong Password, and Security Code AutoFill
- URL: https://developerinsider.co/ios12-password-autofill-automatic-strong-password-and-security-code-autofill/
- Published: 2018-09-25T18:38:35.000Z
- Updated: 2026-10-10T07:05:07.000Z
- Description: Passwords and Security Codes are a modern necessity required for security and privacy. iOS 12 eases the tedious aspects of account setup and sign-in by automatically suggesting and using strong, unique passwords and by bringing one-time password to the QuickType bar.
- Author: Vineet Choudhary
- Tags: iOS, iOS 12, Security

Passwords and Security Codes (OTP) are a modern necessity required for security and privacy. iOS 12 eases the tedious aspects of account setup and sign-in by automatically suggesting and using strong, unique passwords and by bringing one-time password to the QuickType bar so users can fill them with one tap. Here we'll learn how to implement these feature in your app.  
  
First of all, we need to understand how it's work in iOS. So, When your app installs on an iOS device, the system attempts to associate the app with all the domains listed in the app’s associated domains entitlement:

- The system takes each domain from the associated domains entitlement.
- It tries to download the Apple App Site Association file (apple-app-site-association) for that domain.
- If all the steps succeed, the system associates the app with that domain and enables Password AutoFill for that domain’s credentials.

So, first of all, we need to set up App Associated Domains.

## 1\. Setup App's Associated Domains

To set up the Associated Domains in your app, open the projects Capabilities tab and enable Associated Domains. This step adds the associated domains entitlement to your app as well as the associated domains feature to your app ID. Now, To add your domain to the entitlement, click Add (+) at the bottom of the Domains table in order to add a placeholder domain with the `webcredentials:` prefix. To match all sub-domains of an associated domain, specify a wildcard with the prefix `*` before the beginning of a specific domain like `*.developerinsider.co`. Each domain you specify uses the following format:

```txt
<service>:<fully qualified domain>[:port number]

```

![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/iOS12/LoginFlow/Setup%20the%20Associated%20Domains%20in%20your%20iOS%20App.png?raw=true)

## 2\. Add the Apple App Site Association File to your Website

Now, create a file named `apple-app-site-association` (without an extension). The `apple-app-site-association` file needs to be accessible via HTTPS with a valid certificate, without any redirects, at https://{domain}/apple-app-site-association. (like - [https://developerinsider.github.io/apple-app-site-association](https://developerinsider.github.io/apple-app-site-association?ref=developerinsider.co))

```json
{
    "webcredentials": {
        "apps": [
            "4F7SW76LL6.com.di.AutoPassword-iOS12",
            "4F7SW76LL6.com.di.AutoPassword-iOS12.QA",
            "4F7SW76LL6.com.di.AutoPassword-iOS12.Dev"
        ]
    }
}

```

> Note  
> If your site uses different subdomains (such as `developerinsider.co`, `developerinsider.in`, and `tech.developerinsider.co`) each requires its own entry in the Associated Domains, and each must serve its own `apple-app-site-association` file.

To validate your `apple-app-site-association` file you can use [Branch.io Apple App Site Association Validator](https://branch.io/resources/aasa-validator/?ref=developerinsider.co) or [Apple App Search API Validation Tool](https://search.developer.apple.com/appsearch-validation-tool?ref=developerinsider.co).

## 3\. Password AutoFill

Password AutoFill simplifies login and account creation tasks for iOS apps. By default, Password AutoFill saves the user's login credentials on their current iOS device. iOS can sync these credentials securely across the user’s devices using iCloud Keychain. Password AutoFill recommends credentials only for your app's associated domain, and the user must authenticate using Face ID or Touch ID before accessing these credentials.

To enable password autofill on a `UITextField` we need to set the `textContentType` property. Here the examples -

#### 3.1 Login

Here the example defines text fields for **logging in** \-

```swift
//username or email field
usernameTextField.textContentType = .username
usernameTextField.keyboardType = .emailAddress

//password field
passwordTextField.textContentType = .password

```

![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/iOS12/LoginFlow/AutoPassword%20Suggest%20Login.png?raw=true)

#### 3.2 Signup

When **creating a new account**, we need to use the `.newPassword` text content type -

```swift
//username or email field
usernameTextField.textContentType = .username
usernameTextField.keyboardType = .emailAddress

//password field
usernameTextField.textContentType = .newPassword

```

![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/iOS12/LoginFlow/Automatic%20Strong%20Password%20SignUp.png?raw=true)

#### 3.3 Change Password

Also, when **changing the password**, username and new password text fields should be on the same screen, where username field can be read-only -

```swift
//username field
usernameTextField.isEnabled = false
usernameTextField.textContentType = .username
usernameTextField.keyboardType = .emailAddress
usernameTextField.text = UserDefaults.standard.username //logged in user username

//new password field
newPasswordTextField.textContentType = .newPassword
confirmNewPasswordTextField.textContentType = .newPassword

```

![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/iOS12/LoginFlow/Change%20Password.png?raw=true)

iOS supports Password AutoFill on `UITextField`, `UITextView`, and any custom view that adopts the `UITextInput` protocol.

## 4\. Password Saving

iOS will automatically present an alert to save password if everything setup correctly. Here the compatibility checklist -

- Tag fields with correct content types
- Remove login fields from the view hierarchy
- Clear login fields only after removing from the hierarchy
- Check that AutoFill saved to the correct domain

## 5\. Automatic Strong Passwords

If `UITextField` tag with `.newPassword` content type then system suggests a strong, unique password in apps that have an associated domain. It also saves any new credentials for that domain. Remember, username, password and new password text fields should be on the same screen. Here how autofills work

- Check eligibility based on associated domains
- Detect relevant sign up/change password form elements
- Suggest a user name or user need to manually input username
- Insert a strong password or user can choose their own password
- Save the password after the user signs up or change the password

## 6\. Custom Rules for Automatic Strong Passwords

Safari AutoFill has been able to generate automatic passwords since iOS 8, but it couldn't guarantee that a generated password satisfied the requirements of a particular service. In iOS 12, if your service has specific password rules, you can define valid password formats by setting the `UITextField` `passwordRules` property. This property takes a `UITextInputPasswordRules` object, which contains a rules descriptor string.

Here the example -

```swift
let passwordRuleDescription = "required: lower; required: upper; required: digit; minlength: 8; maxlength: 16;"
let passwordRules = UITextInputPasswordRules(descriptor: passwordRuleDescription)
passwordTextField.passwordRules = passwordRules

```

> Note  
> The `passwordRules` property is supported only on `UITextField` objects, and the text field's `secureTextEntry` property must be set to `true`. The API is ignored if it is adopted on any other views.

You can use the [Apple Password Rules Validation Tool](https://developer.apple.com/password-rules/?ref=developerinsider.co) to create custom rules if necessary. You can also generate and download example passwords from Password Rules Validation Tools to validate that your rules accurately reflect what your service accepts.  
![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/iOS12/LoginFlow/Apple%20Password%20Rules%20Validation%20Tool.png?raw=true)

If the thought of working with a string-based format without a proper abstraction is not good. You can use [PasswordRules](https://github.com/NSHipster/PasswordRules?ref=developerinsider.co), a Swift library for defining strong password generator rules.

## 7\. Security Code AutoFill

If the system can parse a security code from an SMS message, the QuickType bar shows the code for up to three minutes after it has been received. If a security code arrives while the text input view is selected, the system pushes the incoming code to the QuickType bar.

To enable security code autofill on a `UITextField` we need to set the `textContentType` property to `.oneTimeCode`. Here the example -

```swift
otpTextField.textContentType = .oneTimeCode

```

To test the format of your SMS code for different languages, text a message to yourself. If you receive a message with an underlined security code, tap on the code. If a Copy Code option appears, the system has recognized your code.

![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/iOS12/LoginFlow/OTP.png?raw=true)

## 8\. A Note on when User Taps on an AutoFill Item

When a user selects an item from the QuickType bar, the system may ask them to authenticate using Face ID or Touch ID. Your app becomes inactive when Face ID or Touch ID appears that will trigger your app delegate's `applicationWillResignActive:` and `applicationDidBecomeActive:` methods. So, Don’t remove your user interface when these methods are called. If you do, the iOS won't be able to autofill the input fields. If you want to hide sensitive information when an app becomes inactive then you can make a check if the user is logged in or not.

![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/iOS12/LoginFlow/TouchID%20to%20Use%20Password.png?raw=true)

## 9\. Sample Project

You can download the sample project from [GitHub](https://github.com/developerinsider/AutoPassword-iOS12-Demo?ref=developerinsider.co).

#### References

- [Password Autofile Rules](https://developer.apple.com/documentation/security/password%5Fautofill/customizing%5Fpassword%5Fautofill%5Frules?ref=developerinsider.co)
- [Apple Security Documentation](https://developer.apple.com/documentation/security?ref=developerinsider.co)
- [Apple Password Rules Validation Tool](https://developer.apple.com/password-rules/?ref=developerinsider.co)
- [WWDC 2018 Session 204](https://developer.apple.com/videos/play/wwdc2018/204/?ref=developerinsider.co)