From ab0e1b47d8210e27177e285cd145e007fba37497 Mon Sep 17 00:00:00 2001
From: Thayol <thayol@uncensored.hu>
Date: Sun, 13 Sep 2026 11:17:19 +0200
Subject: [PATCH] Fix password managers interaction

---
 README.md                | 2 +-
 web/templates/index.html | 7 ++++++-
 web/templates/info.html  | 5 ++++-
 web/templates/login.html | 2 +-
 4 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index b21fdfe..e5878ad 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Built for sharing large binaries with friends so that I don't have to manually m
 
 * One static Go binary, standard library only.
 * Anyone who can reach the page may upload, within a size cap and a lifetime.
-* Named tokens raise those limits, unlock custom URLs, and can grant admin.
+* Named tokens raise those limits, unlock vanity names, and can grant admin.
 
 ## Quickstart
 
diff --git a/web/templates/index.html b/web/templates/index.html
index 5f49b55..a7161ee 100644
--- a/web/templates/index.html
+++ b/web/templates/index.html
@@ -32,7 +32,12 @@
     </p>
     <label class="field">
       <span>Token</span>
-      <input type="password" name="token" autocomplete="new-password">
+      <!-- Plain text on purpose: this is pasted once, behind a collapsed
+           panel, and a masked field only hides the typo. Keeping it out of
+           the password family also stops the browser treating this form as a
+           login and hunting for a username to fill in above. -->
+      <input type="text" name="token" autocomplete="off"
+             spellcheck="false" autocapitalize="off">
     </label>
   </details>
 
diff --git a/web/templates/info.html b/web/templates/info.html
index fa6c4e5..5746500 100644
--- a/web/templates/info.html
+++ b/web/templates/info.html
@@ -40,7 +40,10 @@
         <input type="hidden" name="from" value="info">
         <label class="field">
           <span>Delete token</span>
-          <input type="password" name="token" autocomplete="off" required>
+          <!-- Plain text, like the upload form's: a delete token is pasted
+               once and a mask would only hide a mistake in it. -->
+          <input type="text" name="token" autocomplete="off" required
+                 spellcheck="false" autocapitalize="off">
         </label>
         <button type="submit" class="danger"
                 data-confirm="Delete {{.Meta.Filename}}? This cannot be undone.">Delete this file</button>
diff --git a/web/templates/login.html b/web/templates/login.html
index 8443b55..c7c48a6 100644
--- a/web/templates/login.html
+++ b/web/templates/login.html
@@ -17,7 +17,7 @@
 <section class="card">
   <h1>Log in</h1>
   <p class="hint">
-    A token raises your size and lifetime limits and lets you choose custom
+    A token raises your size and lifetime limits and lets you choose vanity
     names. Logging in keeps it for this browser, so you do not have to paste it
     for every upload. Without one you can still upload anonymously.
   </p>