Auth pages do not support password generation managers due to autocomplete="off"

[DriesCruyskens]

Describe the Bug

The built-in pages for account creation, login, and password reset all have autocomplete="off" on their password input. Consequently, chrome does not propose to generate a password neither when creating the first admin account as well as when resetting your password through the 'forgot password' functionality.

This works fine during log in because chrome password generation manager ignores autocomplete="off" when it detects a username field in the form as explained here. It still breaks account creation and password reset I think because its username also has autocomplete="off" during account creation and there is no username field during password reset.

proposed solutions:
I don't know how to fix it from the top of my head but the following pages might contain a solution:

• https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete
• https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Turning_off_form_autocompletion#managing_autofill_for_login_fields
• https://www.chromium.org/developers/design-documents/password-generation/
• https://www.chromium.org/developers/design-documents/form-styles-that-chromium-understands/#automatically-comprehensible-password-forms

Feel free to point me in the right direction (where in the payload repo I can find this) so I can debug this further myself and create a pull request, or so that I can at least to create a local patch so payload users can get it to work until a fix is made.

The reproduction is just a new pnpx create-payload-app@latest with sqlite with with url-join installed to print the reset URL in email subject so it's available in the console.

Link to the code that reproduces this issue

https://github.com/DriesCruyskens/password-reset-does-not-support-pwmanager

Reproduction Steps

1. Run pnpm dev
2. Navigate to http://localhost:3000/admin in stock chrome
3. Create first admin user. Observe password managers not proposing to generate a password. Observe google password manager saving your credentials.
4. Log out
5. Note that login screen now proposes the previously saved credentials
6. Press "forgot password" on login screen and fill in the email address that you used for the first admin account
7. Use the URL printed in the console to navigate to the password reset screen
8. Observe password managers not proposing to generate a password

Which area(s) are affected? (Select all that apply)

area: ui

Environment Info

Payload: 3.21.0
Nextjs: 15.1.5
Nodejs: 20.17.0

[kishansinghifs1]

Can I work on it ?

[jessrynkar]

Hi @DriesCruyskens, thanks for the detailed issue report and for digging into this!

The reason we have autocomplete="off" on password fields in auth forms comes from a lot of past user feedback around autofill causing unexpected or misleading behavior — so, although not ideal, this was an intentional choice rather than an oversight or bug. The downside is the impact on password generation / management as you have experienced.

Currently, even if we enabled autocomplete on the auth fields, password generation still wouldn’t work due to how our forms are currently built and controlled.

That said, we definitely want to improve this. Password generation / management, adding a visibility toggle and overall UI/UX enhancement of our auth forms are items we plan to support. I will mark this as a feature request so it can be prioritized and hopefully make it onto our roadmap soon.

Thanks for your patience and for raising this 🙏