# What is Password autofill?

> A browser or manager filling your saved credentials into a login form automatically.

Last reviewed: 2026-09-01

## Password autofill

Category: Passwords

Canonical page: https://moolkey.com/glossary/password-autofill

Autofill is a password manager entering your saved credentials into a login form for you. Beyond convenience, it is a quiet anti-phishing control: a manager matches on the exact domain, so if it declines to fill a page that looks familiar to you, that refusal is worth more than your own judgement.

### The security argument for it

Human eyes are poor at spotting a lookalike domain, particularly on a phone where the URL bar is truncated. Software comparing strings is not. Treat a manager that will not autofill as a warning rather than an inconvenience, and check the address before typing anything.

### Where autofill has been risky

Researchers have repeatedly demonstrated attacks where hidden form fields harvest autofilled credentials, and where fills on embedded frames leak to the wrong origin. Reputable managers have hardened against these, but it is a reason to prefer explicit fill on click over silent fill on page load.

### Sources

- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.