Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that she needs to be more careful on computers that others also use.

Is there a way that I can provide a button to forget Alice's login details after she has finished (both username and password)? If she doesn't do this, Mallory has the ability to retrieve her login details.

There are thousands of Alices using my website, so I'm going to assume that trying to educate them all is a losing battle. I'm looking for a solution that works with human behaviour, not against it.

  • Is Mallory's machine treated as trusted while the user logs in (no keylogger etc.)?
    – jrtapsell
    Jun 17, 2018 at 2:03
  • @jrtapsell Yes, Mallory is the user, not the machine. Let's say Mallory has access only after Alice has used it.
    – CJ Dennis
    Jun 17, 2018 at 5:22
  • I think that you're looking for what websites do when you select "trusted device"? Jun 17, 2018 at 5:23
  • 2
    Is it about a password manager or about active sessions? Password managers have a clear delete function in common browsers.
    – allo
    Jul 17, 2018 at 11:34
  • It's better to not save the password at all, than to provide a "Forget the password" functionality and counting on users properly using it.
    – ThoriumBR
    Aug 5, 2020 at 15:14

1 Answer 1


If I'm not mistaken, the browser only saves the information if it is there when either the AJAX request is sent or the page changes.

Now I'm going to get slightly technical given that this isn't StackOverflow, but I won't go into too many details as you should post it there if you have code related questions, but given what you want the process could go like this for a state handling library like React:

  1. the user presses submit.
  2. you delay the execution of the page change/login/ajax request.
  3. you save the information to some state (or a variable).
  4. you set the values of the boxes to generic "user" and "****".
  5. You send the request and log in the user.

I'm not exactly certain if this will work with every browser, but I have noticed that websites tend to do something similar quite often. I will admit that this is highly dependent on the browser, but it always will be and I honestly don't think that browsers are smart enough to know the difference, and if they are, just place the submit button outside of the form (if preventDefault doesn't do the trick first).

  • I don't think that would allow the browser to save the password on Alice's browser either. Alice wants the previous password automatically filled in unless she has deleted it.
    – CJ Dennis
    Jun 17, 2018 at 5:24
  • see my above comment about how websites ask if it is a secure or public device. You would just submit directly if it were a secure device and avoid my provided steps with a simple conditional set by a checkbox if that is the case, or avoid the (imo insecure) browser storage altogether and use something like a jwt if it is a secure device. Jun 17, 2018 at 5:30
  • basically you would avoid education and bring it down to a simple question about whether it is their device or someone else's/a public device. Jun 17, 2018 at 5:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .