I\'ve created a web application which uses a tagbox drop down. This works great in all browsers except Chrome browser (Version 21.0.1180.89).
Despite both the
TL;DR: Tell Chrome that this is a new password input and it won't provide old ones as autocomplete suggestions:
autocomplete="off"
doesn't work due to a design decision - lots of research shows that users have much longer and harder to hack passwords if they can store them in a browser or password manager.
The specification for autocomplete
has changed, and now supports various values to make login forms easy to auto complete:
If you don't provide these Chrome still tries to guess, and when it does it ignores autocomplete="off"
.
The solution is that autocomplete
values also exist for password reset forms:
You can use this autocomplete="new-password"
flag to tell Chrome not to guess the password, even if it has one stored for this site.
Chrome can also manage passwords for sites directly using the credentials API, which is a standard and will probably have universal support eventually.