Programming Tools
Honeypot Tester
Inspect possible honeypot fields and their keyboard and screen-reader exposure locally. Static HTML checks do not submit forms or prove spam protection.
Checks labels, accessible names, grouping, and honeypot clues. Field-validation testing is excluded. This page never runs pasted scripts or submits the inspected forms.
Paste page source or a form fragment, then click Analyze (Ctrl/Cmd + Enter). You can also open a UTF-8 file up to 1 MB (25,000 elements). Include labels and referenced descriptions. HTML is parsed in an inert template and is never displayed as a live form.
Ready. Paste HTML and click Analyze, or open a local file.
Review a honeypot without confusing it with a hidden token
A honeypot is a decoy field intended to stay empty during a legitimate submission. Names and hidden styling are clues, not proof. Hidden nonce, CSRF, tracking, and routing inputs are normal form data; do not fill them as decoys.
What can a static check establish?
These are limited structural checks, not a full accessible-name calculation or a WCAG pass. External CSS, generated content, custom widgets, keyboard behavior, and screen-reader announcements require live review. Missing references may belong to HTML you did not paste. Honeypot effectiveness is always inconclusive from markup alone.
