A lot of browsers ignore off,
autocomplete="new-password" works but then the browser might suggest a strong password, “one-time-code” is officially supported.
But really, you can just use any random string for the field and it should work, like
And if that doesn’t work, this hack generally does:
<input readonly onfocus="this.removeAttribute('readonly');">