How to Turn Off Form Autocompletion

This article explains how a website can disable autocomplete for form fields.

By default, browsers remember information that the user submits through input fields on websites. This enables the browser to offer autocomplete (i.e. suggest possible completions for fields that the user has started typing in) or autofill (i.e. pre-populate certain fields upon load).

These features can be a privacy concern for users, so while browsers can enable users to disable them, they are usually enabled by default. However, some data submitted in forms are either not useful in the future (e.g. a one-time pin) or contain sensitive information (e.g. a unique government identifier or credit card security code). A website might prefer that the browser not remember the values for such fields, even if the browser's autocomplete feature is enabled.

Disabling autocompletion

To disable autocompletion in forms, a website can set the autocomplete attribute to "off":

autocomplete="off"

A website can either do this for an entire form, or for specific input elements in a form:

<form method="post" action="/form" autocomplete="off">
[…]
</form>

<form method="post" action="/form">
  […]
  <div>
    <label for="cc">Credit card:</label>
    <input type="text" id="cc" name="cc" autocomplete="off">
  </div>
</form>

Setting autocomplete="off" here has two effects:

• It stops the browser from saving field data for later autocompletion on similar forms though heuristics that vary by browser.
• It stops the browser from caching form data in session history. When form data is cached in session history, the information filled in by the user will be visible after the user has submitted the form and clicked on the Back button to go back to the original form page.

In some cases, the browser will keep suggesting autocompletion values even if the autocomplete attribute is set to off. This unexpected behavior can be quite puzzling for developers. The trick to really forcing the no-autocompletion is to assign a random string to the attribute, for example:

autocomplete="nope"

Since this random value is not a valid one, the browser will give up.

The autocomplete attribute and login fields

Modern browsers implement integrated password management: when the user enters a username and password for a site, the browser offers to remember it for the user. When the user visits the site again, the browser autofills the login fields with the stored values.

Additionally, the browser enables the user to choose a master password that the browser will use to encrypt stored login details.

Even without a master password, in-browser password management is generally seen as a net gain for security. Since users do not have to remember passwords that the browser stores for them, they are able to choose stronger passwords than they would otherwise.

For this reason, many modern browsers do not support autocomplete="off" for login fields:

• If a site sets autocomplete="off" for a form, and the form includes username and password input fields, then the browser will still offer to remember this login, and if the user agrees, the browser will autofill those fields the next time the user visits the page.
• If a site sets autocomplete="off" for username and password input fields, then the browser will still offer to remember this login, and if the user agrees, the browser will autofill those fields the next time the user visits the page.

This is the behavior in Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11).

If an author would like to prevent the autofilling of password fields in user management pages where a user can specify a new password for someone other than themself, autocomplete="new-password" should be specified, though support for this has not been implemented in all browsers yet.