There are a lot of answers on the subject (including some on StackOverflow), but none of them have recent or updated answers: I can't seem to find any documentation indicating which browsers support autocomplete="off". Can anyone point me in the right direction of a chart of form attributes and browser compatibility?

Password and Username caching on the browser allows an attacker, if by using sophisticated CSRF attack against the protected storage of the browser, or if by physical access to the victims machine to steal the victims credentials.

As a security consultant who wants to give the best practice and most secure solutions to his clients I want to make sure recommending AutoComplete="off" is the right solution to order the browser not to cache the user's credentials. For this I need to know if there are any browsers that don't apply this rule. If such case exists I need to recommend on another solution. Pentesters among us might want this information to R&D special attacks against such browsers, and users might be interested in such information to know what browsers not to use.

  • 7
    Is this a security question? If so, state your security problem. If not, this is the wrong forum.
    – GdD
    Oct 29, 2012 at 11:57
  • Check my question again. I think I made it clear enough. Oct 30, 2012 at 7:53

1 Answer 1


Exact duplicate of SO question (which is more relevant than here): https://stackoverflow.com/questions/3868299/is-autocomplete-off-compatible-with-all-modern-browsers

Basically, most modern browsers attempt to respect it, though it would be trivial to write an javascript extension to ignore/disable it. E.g., with jQuery library they could do something like add the following javascript to every page:

$(document).ready(function() {
 $(":input").attr('autocomplete', 'on');

which would override the autocomplete settings of the website. Basically, your best bet is to set autocomplete='off' and additionally set a policy to tell users to never have the browser remember the password for this website.

  • As you can see, I mentioned in my question that "There are a lot of answers on the subject (including some on StackOverflow), but none of them have recent or updated answers". I did give a thorough explanation why this is a security issue, and why it is relevant to this community. If you don't agree you are welcome to do so on the comments to my question. Oct 30, 2012 at 11:34
  • I am not looking for a way to avoid AutoComplete property, I don't have any control on the user machine, I want to know only if there are browsers that don't respect this property. Making your remark on jQuery and javascript extensions redundant. Also, since I'm looking for a time-proof answer: I am asking if there is a KB that can answer that, so this question won't have to be asked again. Oct 30, 2012 at 11:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .