I found a website that uses the plain text field as a password input form.

<input type = "text" autocomplete= off ...>

I understand shoulder surfing is one vulnerability but are there other vulnerabilities that makes input type="password" a safer option?

  • 1
    One problem is that the browser will not propose to save the password. To me not having that choice is a loss in security (as saving pw is a security bonus but others believe it's a vuln).
    – curiousguy
    Feb 24, 2019 at 4:48

2 Answers 2


Beyond shoulder surfing the browser can insecurely cache data. It may save input fields in an insecure manner, for auto-fill purposes. This means passwords may be tab completed, easily retrieved as plain text, and copy/pasted.


In addition to the other answers, phones using a keyboard with 'next word' suggestion shortcuts will learn from your entry into text fields, but typically not password fields. If you have a password of common English words, it is very plausible that a phone will offer up the next word in your password if you type it, and have previously typed your password into a text field.

Only a serious issue if your phone is compromised or the database of your word predictions are compromised or shared insecurely (such as in a heuristic learning program that shares your phrases with the keyboard vendor for better learning)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .