22815 2013-07-26 17:33:39 +0000 Both autocomplete="on" and autocomplete="off" are UA hints and thus should use MAY, not SHOULD language 2013-09-26 18:04:12 +0000 1 1 1 Unclassified WHATWG HTML unspecified PC All RESOLVED WORKSFORME P2 normal Unsorted 22814 1 eoconnor ian ian mike public-html-admin public-html-wg-issue-tracking contributor oldest_to_newest 91326 0 eoconnor 2013-07-26 17:33:39 +0000 +++ This bug was initially created as a clone of Bug #22814 +++ Currently, the spec for autocomplete="off" says > When an element's autofill field name is "off", the user agent should not remember the control's value, and should not offer past values to the user. And SHOULD, in RFC 2119, basically means "MUST unless you have a really good reason." Consider a site with a user signup form and a login form. The signup form doesn't have autocomplete attributes. A user starts to fill in the registration form, and the user's browser offers to create a new, unique password for this site. The user agrees. Later on, the user browses to the site and tries to log in. The login form has autocomplete="off". Per spec, the UA should not offer to fill in the stored password for the user, because the author expects the user to type the password in themselves. But in this scenario the user doesn't even know the password in the first place. Ultimately, the autocomplete="" attribute represents a hint to UAs, but UAs should be free to do whatever is in their user's interests with the hint. 91334 1 ian 2013-07-26 22:23:28 +0000 It's SHOULD because there's a strong reason for why browsers should follow the hint rather than ignore it: banks will freak out and block you if you don't follow it. So unless you have a good reason to ignore it (such as, you happen to know that the site's password was autogenerated and so the user hasn't a hope in heck of knowing what it is), you shouldn't ignore it.