Password fields display two replacement characters for a single supplementary Unicode symbol. Test case here: data:text/html;charset=utf-8,<input%20type=password%20value=&%23x1D306;> As you can see, two replacement characters are shown instead of one. What’s worse is you can delete each individual surrogate separately.