'If the user wants to be in control of the credential filling, this option is available as an extension preference setting and, for Business users, as a policy,' DeMichele added. 'we always recommend users only visit sites and click on links that they trust to prevent against potential attempts to steal login information.'

'We are constantly evaluating ways to improve the autofill flow to protect our users while still offering a convenient login experience,' said Dan DeMichele, vice president of product management at LastPass. 'The only vulnerability identified is when an attacker has modified the website you're logging into, in which case they can steal your password whether or not you have autofill enabled.'

'The autofill also provides an anti-phishing protection as Dashlane only suggests users' information on the specific website linked to their password,' Rivain added. 'This ultimately increases their chances to continue using a password manager and thus become more and more secure.' 'By activating autofill by default, our users perceive the value of a password manager sooner,' Dashlane Chief Technology Officer Frédéric Rivain told us. Another password manager, Keeper, will autofill passwords on a site-by-site basis with user permission. The Safari and Brave browsers did not autofill passwords, Toth said, nor did the 1Password, RoboForm and Bitwarden password managers. Toth found that most major web browsers, including Chrome, Firefox, Edge, Internet Explorer, Opera and Vivaldi automatically filled in usernames and passwords by default, as did the stand-alone password managers LastPass, Dashlane and Sticky Password.

Malicious scripts can and sometimes do create invisible login fields that you can't see to catch those credentials without your knowledge, as three researchers discovered in 2017 (opens in new tab). Autofilling tries to fill those fields all the time.

1password firefox autofill