真正的问题比在HTML中添加属性要深刻得多——这是常见的安全问题，这就是为什么人们为了安全发明了硬件密钥和其他疯狂的东西。

假设autocomplete="off"在所有浏览器中都能正常工作。这对安全有帮助吗?当然不是。用户将把密码写在课本上，写在每个办公室访客都能看到的显示器上贴的贴纸上，保存在桌面上的文本文件中等等。

一般来说，web应用程序和web开发人员不以任何方式对最终用户的安全负责。最终用户只能保护自己。理想情况下，他们必须把所有的密码都记在脑子里，并使用密码重置功能(或联系管理员)以防他们忘记密码。否则，总有一个风险，密码可以看到和窃取以某种方式。

所以，要么你对硬件密钥有一些疯狂的安全策略(比如，一些银行提供的网上银行基本上采用双因素认证)，要么基本上没有安全。当然，这有点夸张了。重要的是要了解你想要保护的是什么:

Not authorised access. Simplest login form is enough basically. There sometimes additional measures taken like random security questions, CAPTCHAs, password hardening etc. Credential sniffing. HTTPS is A MUST if people access your web application from public Wi-Fi hotspots etc. Mention that even having HTTPS, your users need to change their passwords regularly. Insider attack. There are two many examples of such, starting from simple stealing of your passwords from browser or those that you have written down somewhere on the desk (does not require any IT skills) and ending with session forging and intercepting local network traffic (even encrypted) and further accessing web application just like it was another end-user.

In this particular post, I can see inadequate requirements put on developer which he will never be able to resolve due to the nature of the problem - end-user security. My subjective point is that developer should basically say NO and point on requirement problem rather than wasting time on such tasks, honestly. This does not absolutely make your system more secure, it will rather lead to the cases with stickers on monitors. Unfortunately, some bosses hear only what they want to hear. However, if I was you I would try to explain where the actual problem is coming from, and that autocomplete="off" would not resolve it unless it will force users to keep all their passwords exclusively in their head! Developer on his end cannot protect users completely, users need to know how to use system and at the same time do not expose their sensitive/secure information and this goes far beyond authentication.

autocomplete="off"不能在Firefox 31中禁用密码管理器，在一些早期版本中也很可能不能。

查看mozilla关于此问题的讨论: https://bugzilla.mozilla.org/show_bug.cgi?id=956906

我们希望使用第二个密码字段输入由令牌生成的一次性密码。现在我们使用文本输入而不是密码输入。:-（

使用真正的双因素身份验证来避免对密码的唯一依赖，因为密码可能存储在比用户浏览器缓存更多的地方。

我一直在做的是autocomplete="off"和使用javascript / jQuery清除密码字段的组合。

jQuery示例:

$(function() { 
    $('#PasswordEdit').attr("autocomplete", "off");
    setTimeout('$("#PasswordEdit").val("");', 50); 
});

通过使用setTimeout()，您可以等待浏览器在清除字段之前完成该字段，否则浏览器将总是在您清除字段后自动完成。

恕我直言, 最好的方法是随机选择type=password的输入字段的名称。 使用“pwd”前缀，然后是一个随机数。 动态创建字段并将表单呈现给用户。

您的登录表单看起来像…

<form>
   <input type=password id=pwd67584 ...>
   <input type=text id=username ...>
   <input type=submit>
</form>

然后，在服务器端，当您分析客户端发布的表单时，捕获以“pwd”开头的字段，并将其用作“password”。

网站有没有办法告诉浏览器不要提供记住密码的功能?

该网站通过使用<input type="password">告诉浏览器这是一个密码。所以如果你必须从网站的角度来做这件事，那么你就必须改变它。(显然我不建议这样做)。

最好的解决方案是让用户配置浏览器，这样它就不会记住密码。