使用真正的双因素身份验证来避免对密码的唯一依赖，因为密码可能存储在比用户浏览器缓存更多的地方。

如果autocomplete="off"不起作用…删除表单标签并使用div标签，然后使用jquery将表单值传递给服务器。这对我很管用。

<input type="text" id="mPassword" required="required" title="Valid password required" autocomplete="off" list="autocompleteOff" readonly onfocus="this.removeAttribute('readonly');" style="text-security:disc; -webkit-text-security:disc;" oncopy="return false;" onpaste="return false;"/>

网站有没有办法告诉浏览器不要提供记住密码的功能?

该网站通过使用<input type="password">告诉浏览器这是一个密码。所以如果你必须从网站的角度来做这件事，那么你就必须改变它。(显然我不建议这样做)。

最好的解决方案是让用户配置浏览器，这样它就不会记住密码。

我不确定它是否能在所有浏览器中工作，但你应该尝试在表单上设置autocomplete="off"。

<form id="loginForm" action="login.cgi" method="post" autocomplete="off">

禁用表单和密码存储提示并防止表单数据在会话历史中缓存的最简单和最简单的方法是使用值为“off”的自动完成表单元素属性。

从https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

一些小研究表明，这可以在IE中工作，但我不能保证;)

@Joseph:如果严格要求通过实际标记的XHTML验证(不知道为什么会这样)，理论上你可以在之后用javascript添加这个属性，但禁用js的用户(可能可以忽略不计，如果你的网站需要js，则为零)仍然会保存他们的密码。

jQuery示例:

$('#loginForm').attr('autocomplete', 'off');

真正的问题比在HTML中添加属性要深刻得多——这是常见的安全问题，这就是为什么人们为了安全发明了硬件密钥和其他疯狂的东西。

假设autocomplete="off"在所有浏览器中都能正常工作。这对安全有帮助吗?当然不是。用户将把密码写在课本上，写在每个办公室访客都能看到的显示器上贴的贴纸上，保存在桌面上的文本文件中等等。

一般来说，web应用程序和web开发人员不以任何方式对最终用户的安全负责。最终用户只能保护自己。理想情况下，他们必须把所有的密码都记在脑子里，并使用密码重置功能(或联系管理员)以防他们忘记密码。否则，总有一个风险，密码可以看到和窃取以某种方式。

所以，要么你对硬件密钥有一些疯狂的安全策略(比如，一些银行提供的网上银行基本上采用双因素认证)，要么基本上没有安全。当然，这有点夸张了。重要的是要了解你想要保护的是什么:

Not authorised access. Simplest login form is enough basically. There sometimes additional measures taken like random security questions, CAPTCHAs, password hardening etc. Credential sniffing. HTTPS is A MUST if people access your web application from public Wi-Fi hotspots etc. Mention that even having HTTPS, your users need to change their passwords regularly. Insider attack. There are two many examples of such, starting from simple stealing of your passwords from browser or those that you have written down somewhere on the desk (does not require any IT skills) and ending with session forging and intercepting local network traffic (even encrypted) and further accessing web application just like it was another end-user.

In this particular post, I can see inadequate requirements put on developer which he will never be able to resolve due to the nature of the problem - end-user security. My subjective point is that developer should basically say NO and point on requirement problem rather than wasting time on such tasks, honestly. This does not absolutely make your system more secure, it will rather lead to the cases with stickers on monitors. Unfortunately, some bosses hear only what they want to hear. However, if I was you I would try to explain where the actual problem is coming from, and that autocomplete="off" would not resolve it unless it will force users to keep all their passwords exclusively in their head! Developer on his end cannot protect users completely, users need to know how to use system and at the same time do not expose their sensitive/secure information and this goes far beyond authentication.