Already been answered, but let me give another idea.

Instead of trying to enforce something unenforceable (even attempting would be such an evasion or privacy)...

Why don't you just stop it at the source and require the user to type (not copy) the password into the field. Yes, it can be disabled by messing with the HTML/JS, but that takes knowledge and even if they have that knowledge it's often too much trouble than its worth to just type the password.

Autofill passwords are so convenient too but usually pose as much of a security risk unless you are in the habit of locking up your screen whenever you walk away.

Already been answered, but let me give another idea.

Instead of trying to enforce something unenforceable (even attempting would be such an invasion of privacy)...

Why don't you just stop it at the source and require the user to type (not copy) the password into the field. Yes, it can be disabled by messing with the HTML/JS, but that takes knowledge and, even if they have that knowledge, it's often more trouble than it's worth to just type the password.

Autofill passwords are so convenient too but usually pose as much of a security risk unless you are in the habit of locking up your screen whenever you walk away.