Preview draft. Copy and visuals are pending review and may change before launch.

Concept

The role of password managers and credential autofill trust

A password manager's whole value depends on it being genuinely strict about where it's willing to autofill. A loose match turns a security tool into a phishing accomplice.

← Back to the library

Identity, Credentials, and Authentication · Published 2026-09-07

Real convenience, resting on how strict the match actually is

Credential autofill is a password manager automatically inserting a stored username and password into a login form it determines belongs to the site the credential was originally saved for. The value is genuine: it removes the temptation to reuse a memorable password across sites, since the manager remembers a unique one for each. That value depends entirely on how accurately the manager determines the current page is actually the site the credential belongs to, rather than a convincing lookalike.

A manager that matches loosely — by visual similarity or a partial domain match — can be tricked into autofilling credentials onto a phishing page that merely resembles the real site closely enough to fool the matching logic, even though it would never have fooled the underlying strict origin check a well-implemented manager actually relies on.

The same underlying protection passkeys provide, applied to passwords

This is the same origin-verification discipline that makes passkeys structurally phishing-resistant, applied here to a different, older mechanism — with a real, if narrower, version of the same protection when the matching is done strictly against the verified origin rather than loosely against surface appearance. A password manager built to that same rigor turns an old, generally weaker credential type into something considerably more resistant to exactly the phishing attacks that plain, manually-typed passwords remain fully vulnerable to.