Is it a good practice to keep autocomplete on in login form?

1. Should I disable autocomplete?
2. Why is autocomplete a security risk?
3. How do I secure autofill?
4. What does autocomplete new password do?

Should I disable autocomplete?

The biggest concern with autofill is privacy and how a hacker can easily obtain personal information. It is simple to trick a browser or password manager into giving up saved login credentials to a malicious person via phishing. The best way for you to prevent any attack is to disable Autofill in any browser you use.

Why is autocomplete a security risk?

The Dangers of Autofill

To acquire your data, a hacker can add an invisible auto-fill form to a webpage. Autofill knows there is a form on the page and can give up your information, allowing the hacker to collect your credentials.

How do I secure autofill?

Go to Settings > System > Language and input > Autofill service. Note: Depending on your device model, the access to Autofill may be different from the above. Go to device settings and search for "autofill" or consult your device manual for more information. Select ID PROTECTION as your service, and then select OK.

What does autocomplete new password do?

If you are defining a user management page where a user can specify a new password for another person, and therefore you want to prevent autofilling of password fields, you can use autocomplete="new-password" .