Design Forms That Work With Password Managers

Forms & Inputs · forms, authentication, security

Updated 2026-07-28

Assume a password manager is filling your form. Most security-conscious users have one, and a form that fights it pushes them towards weaker passwords they can type.
Label every field with a standard autocomplete meaning. Managers and browsers rely on those hints, and a custom field name means the user fills everything by hand.
Use a real form with real inputs. Custom components built from other elements are invisible to the tools people rely on to sign in.
Distinguish the current password from a new one. Without that difference, a manager will offer the old password on a change-password screen and save the wrong value afterwards.
Never block paste. Preventing it does not improve security, it simply guarantees shorter, memorable, reused passwords.
Keep the username field present on the password step of a multi-step sign in, even if it is read-only, so the manager knows which credential to use.
Do not split codes or card numbers across several inputs unless the fields still accept a full pasted value and distribute it automatically.
Let the browser save after a successful submit. Replacing the page before the submit completes stops the save prompt from ever appearing.
Test the whole cycle with an actual manager, including sign up, sign in, and password change, because each step breaks differently.

Fighting password managers is fighting the main reason ordinary users have strong passwords at all.