The default button fired by Enter must not be a destructive action

What it is

In many desktop frameworks, Enter fires the dialog’s default button, which need not be the focused control. Focus can sit on Cancel while Enter still hits the one with the default ring—often OK. That Enter target must not be Delete, Empty, or an irreversible submit. The default button is the keyboard’s implicit aim, easier to miss seeing than focus, because it may only add a stroke.

Why it happens

The default button comes from window systems: Enter = accept this dialog’s main proposal. It lets a form submit from the last field without Tab to the button. If a destructive dialog still makes Delete the default, Enter deletes while the person is still reading, or while focus is elsewhere. That is a second path from “focus is on Delete”: fix focus and leave the default, and Enter still destroys data. Habituation is stronger here because Enter has “succeeded” in every other dialog. If the default stroke is weak, people do not know where Enter will land; if it is strong, Delete looks like the primary. The right move is to point the default at a safe or constructive item, or to have no default in a destructive dialog so an explicit click or Tab is required.

Studying it

Focus Cancel, default button is Delete, press Enter. Another condition: no default, Enter should do nothing or activate only the focused control.

Independent variables: which control is default, whether it is split from focus, whether a default stroke is drawn. Dependent variables: whether Enter deletes, whether people expected Enter to hit focus, slips across a chain of dialogs.

Testing Tab then Space measures focus, not the default button. Use Enter, with focus deliberately on another control.

Where it stops holding

macOS and Windows do not fully agree on “Enter always hits the default”; some controls activate focus on Enter. On the Web, <button type="submit"> is the default in a form even when focus is in a field. A one-button dialog can only default that one. Command-line confirms (y/N) treat the uppercase as default; danger should be lowercase and not default.

Applying it

• Do not set a default submit on a destructive dialog; Enter must not delete. A constructive form may default Save.
• If the platform requires a default, make it Cancel and draw the default stroke, so Enter does not hit an invisible Delete.
• Check which type="submit" in an HTML form eats Enter; make danger type="button".
• Verify with focus on Cancel, then Enter. If the object is gone, the default button pointed at a destructive action.

Related

• Within the group: E1.18.1 Default focus should land on a non-destructive option, not on danger · E1.18.2 Bottom sheets and centered dialogs may follow different button-order conventions · E1.18.4 A cross-platform product should follow each OS’s order
• Adjacent: E1.16 Link and button semantics · E1.03 Destructive action buttons · H3.06 Friction for destructive actions
• Search terms: default button · Enter key · type=submit