Auth & Client-Side Security
low Severity
Free Check
Password Field Autocomplete Policy
Ensures sensitive password inputs leverage autocomplete="current-password" or "new-password" for password manager integration.
Why It Matters
Proper autocomplete attributes enable password managers to generate high-entropy passwords and prevent clipboard exposure.
How We Check This
We verify that input[type="password"] fields declare appropriate autocomplete attributes.
How to Fix & Implement
Copy-paste configuration blocks tailored for your web server or edge proxy.
nginx snippet
<input type="password" name="password" autocomplete="current-password" required>
Frequently Asked Questions
Should autocomplete be set to off for passwords?
No, modern security standards recommend autocomplete="current-password" to encourage password manager use.