Yes, you're right, this isn't a great solution for credit card inputs either. They should be able handle dashes and other spacing characters and the site should be able to filter/format it automatically either on the front-end before submission or with some server-side processing. And no we don't need four different input boxes to enter a credit card numbers either.

Flexibility is key here and since many websites handle things differently (and since many of the physical cards have literal dashes on them, which they are looking at when inputting the numbers), you should be able to guide your user into the right format without them having to get error messages or other nonsense.

Not enough web designers appreciate the anxiety of having to input a credit card number or other format-varied content into input boxes.

A fun edge case, of the million edge cases for credit cards:

If you have Japanese users, their browser/input method editor may send full-width characters by default, such as 4321 instead of 4321. You should probably honor those, but unless you wrote code to do this, you almost certainly won't. Even most Japanese sites are user-hostile here, either failing to detect them as numbers or telling the user "You wrote your number in full-width characters; please try again in half-width characters" despite them being trivially convertable.

(Disclaimer: this is professionally relevant to me and yes, Stripe Elements / Checkout do do the right thing here.)

For reference by others: You want to apply NFKC or NFKD Unicode normalization to collapse full-width Latin letters and digits to their usual form. This also widens half-width kana.

Part of the problem is that inputs don't necessarily reflect the specific intent behind the use of certain symbols. For 99% of people using US keyboards when they input a dash in a credit card number they are using the exact same key as one would use for the minus when inputting a negative number. If you asked them to verbalize their inputs they would probably use different words for the same symbol, signifying that the meaning or intent isn't the same but even that isn't entirely reliable.

You can attempt to infer intent or meaning based on the context of the input field but often the least-problematic method is to provide instruction/hints with the field, examples of correctness, and real-time validation with specific syntax errors when invalid or unexpected data is provided. I'd argue that it would also be worthwhile to request clarity from the user when an input hits a filtering rule so that they can make clear their intent... e.g. if you assume that they're using "-" as a symbol for separation rather than simply follow that assumption, ask if that's the case and list other optional valid contexts for that symbol so they can be explicit. If they choose None of the Above or a context that is inappropriate for the field, inform them of that.

The 4-box credit card form, while pretty terrible in many ways, at least made explicit the expectations. Often we now hide the expectations and either auto-reformat what was put in the field (which can be surprising to the user or worse can modify their input to mean something other than what they intended) or do hidden filtering, which can have the same problems but doesn't even bother to inform the user of the changes.

> when they input a dash in a credit card number they are using the exact same key as one would use for the minus when inputting a negative number

So what? I can't imagine any possible way it would be unclear whether someone entered a credit card number or a negative number. They have different numbers of "-" in completely different places. Am I missing something?

> I'd argue that it would also be worthwhile to request clarity from the user when an input hits a filtering rule so that they can make clear their intent... e.g. if you assume that they're using "-" as a symbol for separation rather than simply follow that assumption, ask if that's the case and list other optional valid contexts for that symbol so they can be explicit. If they choose None of the Above or a context that is inappropriate for the field, inform them of that.

That sounds like such bad usability I'd assume you were joking if the rest of your post didn't sound so serious.

Note that my post isn't limited to credit card inputs, nor do I say that the request for clarity is mandatory in all fields.

What I'm advocating is a focus on ensuring the user's explicit intent rather than attempting to infer intent or making hidden assumptions that either could be wrong or exist to make things easier for the developer.

Too many times I've had to deal with data that someone optimistically sanitized or filtered client-side and then stored, only to discover the sanitizing/filtering rules were wrong and the original data provided by the user was lost because the only thing stored was the result of those rules.

> Note that my post isn't limited to credit card inputs

Not your entire post, but the part about the '-' key was pretty specific and narrow-scoped.

> What I'm advocating is a focus on ensuring the user's explicit intent rather than attempting to infer intent or making hidden assumptions that either could be wrong or exist to make things easier for the developer.

'explicit intent' sounds like a nice goal but asking the user inside the form is not going to give you good info, and it will very often annoy them.

> only to discover the sanitizing/filtering rules were wrong and the original data provided by the user was lost because the only thing stored was the result of those rules

It wouldn't hurt to store the original. Even if the user told you what they meant, they might have said the wrong thing.

Not to mention that some countries use . as a decimal point and , as a digit grouping separator, and others do it the other way around.

Yes, I'm rather glad I haven't had to deal with localizing decimal inputs, just displaying them.

I have had to deal with localizing date inputs though. Ugh.

Why is this "ugh"? The way I see it, we're building software for users, and we try to make it useful for them. And part of that is trying to come up with a pleasing and easy to understand design language. And another part of it is catering to different cultures and languages.

For example, afaik, the standard way Chinese dates are written is something like "2020Y02M28D" but with the Chinese characters (words) for year, month, and day, instead of Y, M D. I find this totally beautiful: it doesn't take up more space than "-" or "/" or "." as a separator, and it totally disambiguates the meaning. (Well, there is the trailing "day", so we are losing one character.). It is such a wonderful use of the fact that Chinese is using ideographic characters. Isn't it?

I enjoy creating software users find useful.

But it goes beyond "this is what they do". Users tend to do a wide range of things when entering dates and you kinda have to guess what they mean. Throw in guessing what localization should be used (it's not always clear) on top of that fuzzy system and it can become a frustrating experience for everyone involved.

> Not enough web designers appreciate the anxiety of having to input a credit card number or other format-varied content into input boxes.

I feel most of these things should be solved by browsers, not designers...

Problem is for something like credit card every single browser vendor will try to plug their own service in one way or another (think Apple Pay and Android Pay).

Important to note that in the article we mention we only use pattern to trigger the right keyboard in old iOS. We actually turn off HTML validation in favour of doing server side validation, we'll soon be publishing guidance on that too. Disclaimer - I work on the team.

Why are you going to server-side only? I've always held that client-side validation is important for UX as it provides instant feedback and doesn't need any extra work to preserve the other data that's already been input. Obviously the inputs still need to be validated on the server e.g. to protect against things that get past (or bypass) the client-side checks, or perform more expensive validation.

We'll be publishing soon on the GOV.UK Design System, but in summary we can't make browser validation consistent with our Design System, or guarantee it's always accessible.

In our research it's commonly most often helpful to validate when the user submits as that's when you can be sure they're 'done'. There are cases when realtime helps so it's fine to add it in those situations.

Disclosure* - you're claiming to be on the team, not disclaiming it.

It won't accept it.. in exactly the right way.

Because you can't enter spaces, they don't get submitted, and validation doesn't fail.

As long as they don't also do 'class="nopaste"' or whatever, we're golden!