There's an extra reason why pasting might be disabled on password creation fields: to prevent typos. If I mistype my password in the first box and then copy-paste it into the second, the text will match and my account gets given the mistyped password. You'll then never be able to log in.
If you force the user to type the password in twice, typos will be spotted immediately and can be fixed.
None of this affects password lockers like LastPass since they can autofill these forms in despite the HTML.
If you force the user to type the password in twice, typos will be spotted immediately and can be fixed.
None of this affects password lockers like LastPass since they can autofill these forms in despite the HTML.