Non-autofilling custom fields

Feature Requests Password Manager
1

I think not all custom fields should be automatically filled in when filling a form. The rationale is that some login and card entries need to include some information that is not needed for login/payment. Examples include two-factor authentication recovery codes and card pin codes which need to be stored securely but should almost never be filled on a form. Currently they get filled in if a malicious form has a hidden field named “pin” or “recovery codes”. Using notes field for storing these fields is not an option because pins and recovery codes act like passwords so they should be hidden when browsing entries.

I think there are three easy ways to achieve this: Either add a checkbox next to each custom field which controls whether the field gets automatically filled or not, or add a field name prefix which prevents automatic filling, or force everyone to use csv= prefix for all automatically filled fields.

On a related note, the user interface should inform the user better that the custom fields are actually used to automatically fill in forms and that they are not just additional info related to the entry.

2

I personally store recovery codes and similar items in the notes field.

3

I don’t like to store anything private in the notes field as it is visible to everyone sitting next to me. For recovery codes this might not be that bad as they are quite hard to remember, but for something like four-digit credit card pin code it is definite no-no. If someone gets the pin code and the physical card, then they can impersonate me and the bank won’t refund the credit fraud because pin code counts as strong identification. That’s why I would like to have custom hidden fields which aren’t automatically filled in. Even a hidden notes field would be better than nothing, but I would prefer something more structured.

For reference, at least KeePass has the functionality to store extra hidden fields along with entries.

4

I’d vote for this feature (but don’t have free votes)
As a workaround, I’d propose disabling auto-fill until it isn’t implemented

5

The other option is to use a custom field of type “hidden” - it’ll hold a lot of data, just not easily readable (like a note).

6

The hidden field is still automatically filled to a form if the field has the same name. This is especially problematic with credit card pin numbers.

7

Can’t you just give the custom field a strange name? Something like “CreditCardPIN-4&dRt4S@”. That shouldn’t match anything!

8

I could do that, but I feel like that’s a hack, and besides it makes the name uglier :slightly_smiling_face: . It is also non-obvious that this is necessary in the first place. At least I expected the custom fields to be akin to “String fields” in KeePass which are never automatically typed unless specially instructed to.

Before this feature gets implemented, I probably need to obfuscate the names of the fields.