What is password autofill?
Autofill is a password manager entering your saved credentials into a login form for you. Beyond convenience, it is a quiet anti-phishing control: a manager matches on the exact domain, so if it declines to fill a page that looks familiar to you, that refusal is worth more than your own judgement.
- Topic
- Passwords
- Reading time
- 1 min
- Reviewed
On this page
The security argument for it
Human eyes are poor at spotting a lookalike domain, particularly on a phone where the URL bar is truncated. Software comparing strings is not. Treat a manager that will not autofill as a warning rather than an inconvenience, and check the address before typing anything.
Where autofill has been risky
Researchers have repeatedly demonstrated attacks where hidden form fields harvest autofilled credentials, and where fills on embedded frames leak to the wrong origin. Reputable managers have hardened against these, but it is a reason to prefer explicit fill on click over silent fill on page load.
Sources
These primary references support the terminology and current security guidance used in this definition.
