From db0eb9ebc4bbe88956988d0a6bc2adcdf9f95f19 Mon Sep 17 00:00:00 2001
From: Oleksandr Kozachuk <201152+ok2@users.noreply.github.com>
Date: Mon, 8 Jun 2026 21:59:16 +0200
Subject: [PATCH] web: stop browser autofill on the name + master fields
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The master and pass-overlay inputs are now type=text with a CSS visual mask
(-webkit-text-security) instead of type=password, so the browser never treats
them as password fields — no autofill, no save prompt, no 'suggest strong
password'. Added autocomplete=off + autocapitalize/autocorrect off and
data-1p-ignore / data-lpignore / data-bwignore on the name + master + pass.
---
 helwasm/index.html | 6 +++---
 helwasm/style.css  | 5 +++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/helwasm/index.html b/helwasm/index.html
index ae1648d..67a752f 100644
--- a/helwasm/index.html
+++ b/helwasm/index.html
@@ -102,11 +102,11 @@
         <div class="fields">
           <div class="field">
             <label for="qname">Name (+ optional rules)</label>
-            <input type="text" id="qname" placeholder="github    or    github 20R 99 2024-01-01" autocomplete="off" spellcheck="false" autofocus />
+            <input type="text" id="qname" placeholder="github    or    github 20R 99 2024-01-01" autocomplete="off" autocapitalize="off" autocorrect="off" spellcheck="false" data-1p-ignore data-lpignore="true" data-bwignore="true" autofocus />
           </div>
           <div class="field">
             <label for="master">Master password</label>
-            <input type="password" id="master" placeholder="your master phrase" autocomplete="off" />
+            <input type="text" id="master" class="mask" placeholder="your master phrase" autocomplete="off" autocapitalize="off" autocorrect="off" spellcheck="false" data-1p-ignore data-lpignore="true" data-bwignore="true" />
           </div>
         </div>
         <div class="result">
@@ -178,7 +178,7 @@
         <p class="hint">Cache a master/parent password for this name (used by <code>enc</code> in its subtree). Kept in memory only.</p>
         <div class="field">
           <label for="passInput">Password</label>
-          <input type="password" id="passInput" autocomplete="off" />
+          <input type="text" id="passInput" class="mask" autocomplete="off" autocapitalize="off" autocorrect="off" spellcheck="false" data-1p-ignore data-lpignore="true" data-bwignore="true" />
         </div>
         <div class="row">
           <button class="btn" id="passOk">Set</button>
diff --git a/helwasm/style.css b/helwasm/style.css
index 0e03419..32aaa60 100644
--- a/helwasm/style.css
+++ b/helwasm/style.css
@@ -150,6 +150,11 @@ input[type="text"], input[type="password"] {
   transition: border-color .15s, box-shadow .15s;
 }
 input:focus { border-color: var(--ocean); box-shadow: 0 0 0 3px rgba(27, 65, 97, 0.12); }
+/* Masked TEXT inputs (master, pass overlay): visually masked but type=text, so
+   the browser never treats them as password fields — no autofill / save / "suggest
+   strong password". Firefox uses the bundled disc font. */
+input.mask { -webkit-text-security: disc; }
+@supports not (-webkit-text-security: disc) { input.mask { font-family: "text-security-disc", var(--mono); } }
 
 /* Buttons */
 .btn {