Summary

  • Microsoft's older Internet Explorer documentation shows AUTOCOMPLETE="off" keeping an example text field out of the browser's AutoComplete store. One HTML attribute gave the page a useful way to quiet ordinary form memory.
  • Firefox 30, released on 10 June 2014, stopped letting a form's autocomplete="off" prevent the password manager from offering to save a login. The browser could ask; the user made the saving decision.

The website had hung a tidy sign on the form: OFF. In Microsoft's Internet Explorer developer example, a text box bearing AUTOCOMPLETE="off" is specifically excluded from the AutoComplete store. The same page says its saving method existed in Internet Explorer 5 and later. The sign had a practical job. A one-time field did not need to follow a visitor home like an overeager dog.

Password saving put a different decision behind the same sign. A site could mark a login form off; the browser's password manager then faced the question of whether it should offer its services at all. Mozilla's original Bugzilla discussion shows developers separating two things often thrown into the same drawer: generic form autocompletion, which recalls field values, and a password manager that asks permission to store a login. The bug targeted the second drawer. The site had written on the first one.

Firefox 30's release notes pin the change to 10 June 2014. Their Security section says a form marked autocomplete="off" no longer prevented passwords from being saved. The browser's offer was the visible hinge. A page could express a preference, but the person using Firefox could accept the offer to remember the credential or decline it. The page had lost its quiet veto over that conversation.

The argument in the Bugzilla record had real edges. Some participants worried about a shared machine or a password appearing in the wrong form; others pointed to people choosing weaker, memorable passwords when sites blocked their managers. Mozilla's implementation discussion treated permission to save and the later mechanics of filling as separate questions. That separation kept the decision concrete: Firefox 30 changed the offer to remember a login. It did not need to turn every form field into a souvenir shop.

The distinction survives in Mozilla's current form guidance. autocomplete="off" still tells the browser not to retain ordinary field values for future form completion and affects session-history repopulation. For login fields, modern password management can still offer to remember credentials. Mozilla also names autocomplete="new-password" for a field where someone is setting another person's password; a field can say what it is for without impersonating the user's choice.

The HTML Living Standard gives off sensible work: sensitive or one-time input, or a page providing its own completion mechanism. The attribute was not a comic villain. The comic part was asking one sign to govern two different kinds of memory. Firefox moved the password-saving question out from behind the sign and back to the person who owned the browser.