Is Password Manager Autofill Safe?
By Harshil Kachhadiya · Updated · 4 min read
Autofill saves time, but it only helps if it fills the right credentials into the right site. The details of how a password manager decides what to fill make the difference.
Autofill is a phishing defence when done right
A well-built password manager fills a login only on the exact website where it was saved. If you land on a look-alike address, nothing fills in, which is a strong warning sign that something is wrong. Typing passwords by hand removes that signal.
Exact hostnames, not just similar domains
Some tools match on the registrable domain, so a login saved for one subdomain is offered on every other subdomain of the same company. That is convenient but risky when subdomains hold different accounts, or when one of them hosts user-generated content.
Padlock matches the exact hostname. A login saved for hrms.example.com is suggested only on hrms.example.com, not on mail.example.com or example.com. The leading www is ignored, so www.example.com and example.com are treated as the same site.
Safeguards worth looking for
When evaluating any password manager, check whether it:
- Fills automatically only on HTTPS pages.
- Never overwrites a field you already typed in.
- Requires a click, rather than filling silently, when more than one login matches.
- Lets you turn automatic filling off for individual sites.
- Shows suggestions only for the current site, not your whole vault.
Habits that keep you safe
Check the address bar before you enter anything sensitive, keep your browser and extensions updated, and install extensions only from the official store listing. If your password manager does not offer to fill on a page where you expect it to, stop and verify the URL first.