As I understand it, it's a constant battle between "stop making me enter stuff", and bots or compromised systems.

That's how we have arrived at "please re-enter your 30-character credentials, and no, you can't copy-paste them"

there is one sorta-kinda workaround to autocomplete with the "new-password" attribute value, but that seems a bit hack-y, even if it works. For now.

https://developer.mozilla.org/en-US/docs/Web/Security/Securi...