Is there anything a website code do to prevent any browser from remembering your password? I am aware that from browser's options, users can change setting to ask to remember password or not. But can website have code that disables this feature so that when you visit the website login page and log in, whatever setting your browser may have is now not gonna ask to remember it? My opinion is that you can not really do that from the website like your websites client side javascript code. I am wondering if there is some sort of standard out there that allows this feature.

  • 3
    Even if such a feature existed, you should never trust it as the client is unsecured and can cheat. Oct 8, 2015 at 20:05
  • For some reason, some security team thinks, allowing password managers to remember your password is your web application's fault. I do not know if I agree since you cannot do anything about it as far as I can tell.
    – DoodleKana
    Oct 8, 2015 at 20:10
  • 1
    Related: stackoverflow.com/questions/3868299/…
    – bretik
    Oct 8, 2015 at 20:37
  • @bretik This information is outdated. Auto complete is NOT a password manager. Modern browsers do not remember password fields, but password managers built into modern browsers do if another field is called email, name, username, or one of many other identifiers. Oct 8, 2015 at 21:34
  • 1
    For some reason, some security team thinks, allowing password managers to remember your password is your web application's fault - that means it's time to get a new security team. They seem to be missing the fundamental security concept that you have no control over the client. Oct 8, 2015 at 21:44

2 Answers 2


So first a little bit of information:

Auto Complete is not filling in the login form, a password manager is. Modern browsers will NEVER have auto complete remember a login form!

Password managers are NOT a security flaw or point of attack. An unprotected/poorly designed system, bad users, and bad policies are.

Most browsers these days implement a password manager into their browser(NOT auto complete) that keeps things in a safe and secure location(for google chrome, it's actually stored in your google account cloud). In google chrome, firefox, and edge you can disable the password manager and it will not affect auto complete. This is because auto complete and password manager are two separate sub programs running in the browser. autocomplete=off on a form does not say "Don't Fill In A Form", it says "Don't Remember This Form". However a browser will still probably fill in a login area and ask to remember it because password managers are not auto complete, and thusly ignore this. If the password manager is turned off and you go to a login page, it will not automatically fill in the form even if auto complete is turned on. This is because of the way most modern browsers implement auto complete and their built in password managers. What does this mean? Well it means you, as a web developer, have NO CONTROL over a users browser program itself, just the web page. As such you cannot prevent the password manager form remembering the password, just the same as you can't prevent the user from writing the password on a sticky note or in the mud.

So what can you do to prevent this? Nothing. That's not a bad thing though. You just need to build your website, applications, and services as secure as possible so that if something gets compromised, as little damage as possible happens to your service.

If a security expert tells you a password manager is a security flaw, ask them how they manage their randomly generated, routinely updated secure login credentials and private keys. Then find a new security expert!!!

That being said, a password manager is not something to be feared. It can actually be a GOD send for storing randomly generated, routinely updated enterprise level passwords.

  • Thanks for the answer. I verified that I was not going crazy. I will follow up with them and see exactly why they thought it was a vulnerability of the application.
    – DoodleKana
    Oct 8, 2015 at 21:53
  • 1
    Good. If a security expert ever tells you a user is a vulnerability, you should say duh. Oct 8, 2015 at 22:06
  • Well, it was not so obvious first. It looked like as if they are inferring that password managers store passwords into cookies therefore someone can steal that sensitive information from your cookie. But they had screenshot of chrome's password manager show password selected saying hey your website is allowing this to happen.
    – DoodleKana
    Oct 8, 2015 at 22:28
  • Well glad I helped clear it up. Oct 8, 2015 at 22:30
  • I don't feel safe sticky notes and the password manager either. If you go for lunch and leave your computer logged in, then anybody can use your account. That can be solved by asking for the master password by auto filling each password, but if so, then the master password will be weak, because nobody wants to type something complicated a thousand times a day. I think using an USB key with a hard password to unlock everything would be a best solution. Not sure if that is compatible with modern browsers.
    – inf3rno
    Jul 31, 2019 at 14:04

There was once an autocomplete=off attribute on forms, but this attribute is deliberately ignored in most browsers (Chrome, Firefox, IE) for a while, see The autocomplete attribute and login fields. So the answer is probably that the website has no control if these information are saved or not.

  • The autocomplete is off. But chrome and firefox do not seem to care. It will let you save password in its password manager.
    – DoodleKana
    Oct 8, 2015 at 20:02
  • You can do things like prevent paste from working, but this is considered bad design by most people. The real question is why does your security team think this is even relevant? If they're worried about account compromises, they should be implementing 2 factor auth, not depending on browser features. Oct 8, 2015 at 20:26
  • From bretik's comment, browsers are ignoring this feature going forward. I just witnessed that 2 browsers I tried ignore that feature completely. So, it sounds like wrong assumption the security team is making.
    – DoodleKana
    Oct 8, 2015 at 20:46
  • @DoodleKana: I would suggest that you simply follow the link I have in my answer which gets into more detail which browser ignore the attribute. And with "most browsers" I mention in my answer I really mean the majority, which includes Chrome, Firefox and current IE. Oct 8, 2015 at 20:51
  • Yes, I read it and looked at @bretik stackoverflow.com/questions/3868299/… link. So other than browsers ignoring it there is really no way to disable it from code it seems.
    – DoodleKana
    Oct 8, 2015 at 21:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .