When I have autocomplete off, why does it still fill HTML inputs if saved in browser?

user_4299522 0
Viewed 1457

Is it possible to prevent autofill even when the creds are stored in the browsers logins and passwords?

Or is there a way to prevent creds being saved to the browser?

Or is it better to allow both of these browser features? I'm just think about security if people share machines.

I have tried autocomplete="off" on the inputs and form but it still autofills the fields if there is creds are already stored in the browser and if theyre not then it prompts to save them.

<form autocomplete="off">
  <h1>Login</h1>
  <input type="text" autocomplete="off" placeholder="username" />
  <input type="password" autocomplete="off" placeholder="password" />
</form>

Any help would be appreciated!

autocomplete forms browser html
3 Answers

It's because password autocompletion is not common autocompletion, most modern browsers are using some different mechanics to fill these fields. MDN says it can be disabled by adding autocomplete="new-password" to the fields, though it is new feature and may not work in some browsers. It surely works in Opera 68. So your code should be something like this:

<form autocomplete="off">
  <h1>Login</h1>
  <input type="text" autocomplete="new-password" placeholder="username" />
  <input type="password" autocomplete="new-password" placeholder="password" />
</form>

This question is actually answered here: Disabling Chrome Autofill

user_108687070

If your inputs are actually a username and password, I wouldn't prevent the browser from recognising them as such.

The security issue with computer-sharing is a valid point, but personally I would say this is mostly up to the user. Most computers, for example, have optional settings that the computer password needs to be entered each time autofill is used in the browser. If I knew that my computer and account was being shared, I would definitely turn this setting on.

Also, the pop-up window which asks you to save the password should have the option Never for this website (at least that's how it's phrased in safari, I would assume all browsers offer something similar). If the user knows that a password opens up very sensitive information, they should always choose this option. The browser never saves a password without the user's permission.

As to why your code doesn't work – as far as I can see, you're using the autocomplete="off" attribute correctly, and it should work that way. I think the reason must be that your browser simply ignores this attribute for password inputs. Might be worth checking if the same thing happens in other browsers?

There appear to be many examples of Chrome ignoring this attribute in the past, with various more or less messy solutions. These questions, for example:

user_121661160

This is from MDN:

If a browser keeps on making suggestions even after setting autocomplete to off, then you have to change the name attribute of the input element.

I see you don't use a name attribute so please try that.

user_88015990
Related