---
title: "How cy.prompt generates cy.contains, cy.press, and handles sensitive data"
url: "https://www.cypress.io/blog/how-cy-prompt-generates-cy-contains-cy-press-and-handles-sensitive-data"
description: "Learn what's new in cy.prompt: cy.contains support, cy.press for keyboard steps, not.exist assertions and sensitive data handling."
---

# How cy.prompt generates cy.contains, cy.press, and handles sensitive data

February 26, 2026

By Jennifer Shehane

Not every element is best identified the same way. Sometimes the selector is what's stable. Sometimes it's the content. A few updates in this release open up new ways to write `cy.prompt` steps based on what actually matters in your application. Here's what changed and when to use each one.

* * *

## cy.contains support via text-based targeting

When you put text in quotes inside a `cy.prompt` step, it now resolves to `cy.contains()` instead of `cy.get()`. This is useful when a selector is unstable but the label or content of an element is consistent.

```javascript
'click the "Submit order" button'
```

**Generates:**

```javascript
// Prompt step 1: click the 'Submit order' button
cy.contains(/^\s*Submit order\s*$/).click();
```

Note the regular expression. When `cy.prompt` writes a `cy.contains()` call, it looks for an exact match on the text content. This avoids the default `cy.contains` behavior of matching partial strings, which can target the wrong element when similar text appears elsewhere on the page.

The test is anchored to what's visible. If the selector changes and "Submit order" is still there, the test passes without self-healing.

**Drop the quotes and the behavior is different:**

```javascript
'click the submit button'
```

Without quoted text, `cy.prompt` resolves by structural role:

```javascript
cy.get('[data-test=form-submit-order']).click()
```

That's the right call when the selector is stable but the text might not be, like text that varies by locale.

**The rule of thumb:**

-   Quoted text when exact content is what you're asserting on
-   No quotes when structure is more reliable than content

* * *

## Writing cy.prompt not.exist assertions with cy.contains

`not.exist` assertions now work with text-based targeting, not just CSS selectors:

```javascript
'make sure the "Error" message does not exist'
'confirm the ".reset" button does not exist'
```

**Generates:**

```javascript
// Prompt step 1: make sure the 'Error' message does not exist
cy.contains(/^\s*Error\s*$/).should("not.exist");

// Prompt step 2: confirm the '.reset' button does not exist
cy.get(".reset").should("not.exist")
```

Two things worth noting.

-   Natural language descriptions for non-existence aren't supported yet, so stick to quoted text or exact selectors.
-   These assertions check that the element is gone from the DOM entirely, not just hidden. If you want to test visibility, use visibility language in your step instead.

* * *

## Keyboard testing in cy.prompt with cy.press

If your tests cover keyboard navigation, form submission via Enter, or any interaction that a keyboard user would trigger, `cy.prompt` now has language for that:

```javascript
'press "Tab" to focus the next field'
'press "Enter" to choose the current selection'
```

**Generates:**

```javascript
// Prompt step 1: press "Tab" to focus the next field
cy.press(Cypress.Keyboard.Keys.TAB);

// Prompt step 2: press "Enter" to choose the current selection
cy.press(Cypress.Keyboard.Keys.ENTER)
```

This is especially relevant if you're testing accessible workflows where keyboard navigation is part of the expected user experience.

* * *

## How cy.prompt handles sensitive data in the DOM

When `cy.prompt` reads your application's DOM to resolve element context, it automatically excludes values from certain field types before anything is sent to the AI model:

-   Password fields (`input[type=password]`)
-   Credit card fields using standard autocomplete attributes, including card name, card number, expiry date, security code, and card type
-   Hidden inputs (`input[type=hidden]`)

The structure and surrounding context of those fields are still used to find and interact with them. Only the values are excluded. This matters most when testing login forms, checkout flows, or any workflow that handles credentials.

**Worth being clear about:** this applies to what `cy.prompt` reads from the DOM, not to values you write directly in your step strings. To keep those out of the model too, use placeholders. Placeholder values are never sent to the AI model.

```javascript
cy.env(['USER_PASSWORD']).then(({ userPassword }) => {
  cy.prompt(['type {{password}} in the password field'], {
    placeholders: { password: userPassword },
  })
})
```

* * *

## Try it out

These updates are available now. If you're not already using `cy.prompt`, the [cy.prompt documentation](https://docs.cypress.io/api/commands/prompt?utm_source=blog&utm_medium=inline-link&utm_content=cy.prompt%20documentation&utm_campaign=cy-prompt-features-launch&utm_term=individual-contributor) is the best place to start. If you have questions or run into edge cases, [Cypress Discord](https://discord.gg/cypress?utm_source=blog&utm_medium=inline-link&utm_content=Cypress%20Discord&utm_campaign=cy-prompt-features-launch&utm_term=individual-contributor) is a good place to get help.