Implementing iOS Password Autofill, Strong Password Generation, and One‑Time Code Autofill

This article introduces the password autofill, strong password generation, and security code autofill features described in WWDC18 "Automatic Strong Passwords and Security Code Autofill" and WWDC17 "Introducing Password AutoFill for Apps".

To use these features, the website must support HTTPS and the demo can be hosted on GitHub Pages. iOS 11 provides heuristic autofill for credentials, while iOS 12 adds automatic strong password generation and one‑time code autofill.

Feature 1: iOS 11 Password Autofill (iOS 12 saves to iCloud Keychain)

iOS infers the login scenario, checks associated domains, finds username and password fields via UITextContentTypeUsername and UITextContentTypePassword, and prompts to save or update credentials.

Developer steps:

Enable the Associated Domains service for the app in the Apple Developer portal.

Create an apple-app-site-association JSON file containing the "webcredentials" entry (e.g., {"webcredentials":{"apps":["XW5558TH45.com.beike.testapp"]}}) and host it on the domain under /.well-known/ or the root.

In Xcode, add the domain to the Associated Domains list (e.g., webcredentials:coderxllau.github.io).

Set the textContentType of the relevant UITextField to UITextContentTypeUsername and UITextContentTypePassword.

Code example:

self.userNameField.textContentType = UITextContentTypeUsername;
self.passwordField.textContentType = UITextContentTypePassword;

Feature 2: iOS 12 Automatic Strong Password Generation

Set the password field’s textContentType to UITextContentTypeNewPassword. When the user taps the field, iOS suggests a strong password and can enforce custom password rules via passwordRules.

Code example:

self.nameField.textContentType = UITextContentTypeUsername;
if (@available(iOS 12.0, *)) {
    self.passwordField.textContentType = UITextContentTypeNewPassword;
    self.passwordField.passwordRules = [UITextInputPasswordRules passwordRulesWithDescriptor:@"required: lower; required: upper; allow: digit; required: [-]; minlength: 5;"];
} else {
    self.passwordField.textContentType = UITextContentTypePassword;
}

Feature 3: iOS 12 One‑Time Code Autofill

Set the input field’s textContentType to UITextContentTypeOneTimeCode. iOS detects verification codes in incoming SMS messages and displays them in the QuickType bar.

Developer notes:

Avoid custom keyboard UI that blocks iOS’s autofill UI.

The associated website must use HTTPS.

Do not assign multiple textContentType values to the same field.

Be aware that the demo may capture codes from any SMS source.

References

WWDC18 "Automatic Strong Passwords and Security Code Autofill" WWDC17 "Introducing Password AutoFill for Apps"