🔐 Autofill Security Demo

A cybersecurity proof-of-concept for studying how browser autofill behavior can unintentionally populate fields that are not obvious to the user.

⚠️ Educational and authorized security testing only. Use this project only in environments you own or where you have explicit permission to test. Use dummy profiles and synthetic data; do not collect real credentials, payment information, or personal data.

📖 Overview

Modern browsers and password/profile managers can automatically populate form fields based on HTML autocomplete attributes.

This project demonstrates why users and developers should understand what information a browser may attempt to autofill into a web form.

The demo contains a login-style interface with visible form fields and additional fields associated with common autofill categories. It is intended as a lab project for learning about browser privacy, form security, and secure web-development practices.

🎯 Learning Objectives

• Understand how HTML autocomplete attributes influence browser autofill.
• Explore the privacy risks of unexpected or non-obvious form fields.
• Understand the security implications of browser-stored information.
• Practice reviewing web forms for privacy and security problems.
• Demonstrate autofill risks safely using synthetic data in a controlled environment.

🔍 What This Project Demonstrates

A web form can contain fields associated with different browser autofill categories, including:

• Name
• Email address
• Organization
• Address information
• City, state/region, postal code and country
• Telephone information
• Payment-related autofill fields

This project can be used to study how browsers recognize these fields and decide whether stored information should be inserted automatically.

🧪 Safe Testing

For a controlled demonstration:

1. Clone or download the repository.
2. Run the project only in a local or isolated testing environment.
3. Create a separate browser profile specifically for the experiment.
4. Add fake test information to the browser's autofill profile.
5. Open the demo and observe how the browser handles the form.
6. Use browser Developer Tools to inspect the HTML fields and their autocomplete attributes.
7. Delete the testing profile when finished.

⚠️ Important

Never perform testing with real:

• Passwords
• Credit/debit card numbers
• CVV/CVC codes
• Addresses
• Phone numbers
• Personal identity information
• Other sensitive information

Use synthetic test data only.

🛡️ Defensive Takeaways

For Users

Review autofill prompts carefully before accepting them, particularly on unfamiliar websites.

A page that appears to request only basic information may contain additional form elements, so users should avoid blindly trusting autofill prompts.

For Developers

Forms should be transparent about the information they request.

Developers should:

• Request only information that is actually required.
• Use appropriate autocomplete attributes.
• Avoid unnecessary sensitive form fields.
• Clearly communicate what information is being collected.
• Apply proper server-side validation and security controls.

For Security Teams

Controlled demonstrations of autofill behavior can be useful for:

• Security-awareness training
• Web security education
• Privacy demonstrations
• Secure-development training
• Authorized penetration-testing labs

🧰 Technologies

The project demonstrates concepts involving:

Frontend

• HTML5
• CSS
• JavaScript
• Browser Autofill API behavior

Backend / Runtime

• Node.js
• Express.js

⚖️ Responsible Use

This repository is intended for:

• Cybersecurity education
• Security research
• Browser-security experiments
• Privacy research
• Security-awareness demonstrations
• Authorized penetration testing
• Controlled lab environments

Do not use this project to obtain information from people without their informed consent or authorization.

The repository owner and contributors are not responsible for misuse of the project.

You are responsible for complying with applicable laws, organizational policies, and testing agreements.

👤 Author

Created by Krishna524 as a cybersecurity learning and research project.

⭐ Support

If this project helps you understand browser autofill security and web privacy, consider giving the repository a ⭐.