TL;DR: Browser autofill is a convenience layer on top of a saved login, not a place to invent passwords. Let it store the random string you generated, confirm it offers that string only on the real site, and watch for look-alike domains. If autofill and a dedicated manager disagree, trust the record you updated last and fix the stale one. Generate the secret on the password generator, then teach the browser or manager the finished value instead of typing a memorable substitute “so autofill has something simple.”
The scholarship site that saved the wrong field
A student filled a college portal that put the password on the second step, after a screen that looked like a search box. Chrome offered to save “password” for a field that was actually a student ID search. He accepted. A week later, on the real login, autofill dumped the ID into the password box and his actual password into a comments field he did not notice until a confirmation email quoted it back. The generator had produced a fine secret. The browser had bound it to the wrong box because the page was built strangely and he clicked Save without looking.
Autofill is powerful and occasionally gullible. You stay in charge of what gets stored.
Let the manager learn the generated value once
After the site accepts a new password, the browser will often ask to update the saved login. Say yes if this profile is yours. Say never if you are on a library PC, a family computer with a shared account, or a work kiosk. Decline is not rudeness. It is how you avoid leaving a mail password in a profile that three cousins use.
- Update when you just rotated the password and the prompt names the right site.
- Never on any machine you do not own or that stays unlocked in a shop.
- Check the username the browser wants to pair. Old emails linger as extra identities.
- Prefer the dedicated manager if both the browser and the app offer to save. Pick one system so you do not update only half of them.
Two stores that drift apart feel like the site is “rejecting a correct password.” Usually one of them is offering last year’s secret.
Look-alike pages and the fill that should not happen
Autofill should hesitate on a domain you have never saved. If a page that is one typo away from your bank offers your bank password, stop. That offer means either you saved the password on the fake site earlier or the browser is matching too loosely. Do not fill. Close the tab. Open the bank by typing the address or using your own bookmark. Then change the password if you already filled the fake.
Some sites embed login forms in iframes or bounce through a partner domain. Autofill then looks broken because the saved domain does not match the frame. Filling by hand from the manager is safer than “fixing” the problem by saving the password on every intermediate hop. Extra saved copies multiply the places a later phish can match.
Mobile keyboards that append a space
Phone autofill plus a keyboard suggestion can add a trailing space or “correct” a symbol. If a newly generated password works on the laptop and fails on the phone, look for that extra character before you reset. Show the password in the field if the form allows. Compare length to the manager entry. The generator did not change itself overnight.
Shared browsers inside one household
A family profile that autofills whoever sat down last will eventually put a parent’s mail password into a child’s session, or the reverse. Use separate browser profiles or separate OS accounts. Autofill is per profile. That separation is the feature. Syncing one profile across the house because “it is easier” rebuilds the shared desk drawer you were trying to leave.
When you retire a laptop, sign the browser out and remove saved passwords before it goes to a recycler or a relative. Generated passwords are only as contained as the profile that remembers them.
HTTP pages and mismatched names
A login form served without HTTPS, or a development site on a raw IP address, may not receive a fill from a careful manager. That refusal is healthy. Do not “solve” it by turning off the manager’s secure-fill setting so a lab page can have your real mail password. Create a separate throwaway secret for the lab. Likewise, a saved entry titled with a nickname may not match the host the browser sees. Rename the entry to the real domain so fill works for the right reason, instead of training yourself to paste passwords into any box that asks.
One system of record
Choose the browser’s store or a dedicated manager and update that one during every password change. After you generate a replacement, save it, submit it, accept the update prompt for your chosen store, and try autofill in a private window. If the private window cannot see it, you are in a different profile than you thought. Fix that now, while the generator result is still fresh in the vault you trust.