Autofill
Autofill is a feature of browsers, phones, and password managers that automatically fills form fields with stored data such as name, address, or credit card number. It saves typing effort, but it's only as secure as the place where that data is stored.
Anyone buying something online often has to type in the same details: name, street, postal code, card number. Autofill takes care of that. The program has saved this information at some earlier point and inserts it into the input fields with a single click. This is usually offered by the browser, meaning the program used to access the internet, or by the phone’s operating system. Password managers, meaning programs that store all login credentials in encrypted form, do exactly the same thing. Autofill is therefore not a single app, but a feature built into many different places.
Why forms drive customers away
Every additional input field costs sales. Online retailers have observed for years that many people abandon a full shopping cart when checkout becomes too cumbersome. On a phone with a small keyboard, a sixteen-digit card number is a real obstacle. Autofill shortens this moment from a minute to a few seconds.
That’s why the feature is also economically interesting. Whoever manages users' stored payment data occupies an important position in the purchasing process. Google, Apple, and PayPal have docked their payment services precisely there. A click on the automatically filled field conveniently leads to their own service rather than to a competitor’s.
At the same time, autofill is a security topic. Because filling in data is so effortless, more people use long, random passwords instead of always the same short one. Experts recommend password managers partly for this reason. Convenience here is not a luxury, but the lever that makes secure behavior possible in the first place.
Where the data comes from and how the field is recognized
Autofill needs two things: a data store and a mapping. The store is located on the device or in a user account in the cloud, meaning on the provider’s servers. Passwords and card numbers are stored there in encrypted form and are usually only released after confirmation, for example via fingerprint or face scan. Without this lock, anyone with access to the unlocked device could enter someone else’s data.
The mapping is the more interesting part. The browser has to guess what a field actually wants. Technical hints in the page code help with this: a field can be marked as “email” or “postal code” because the site’s developers set it up that way. If such information is missing, the software searches for keywords in the visible label and in the field’s name.
This is exactly where machine learning comes in, meaning software that derives patterns from many examples. Modern browsers use models that have learned from millions of real forms which field labels typically mean what. This also explains the well-known errors: if the house number is in its own field, the postal code sometimes ends up there instead. A related but different term is autocomplete in search fields. It suggests continuations for text and does not draw on a stored address profile.
Autofill in everyday life and in fraud reports
You encounter autofill almost daily without naming it. The greyed-out suggested address during an online purchase is autofill. The automatically entered password in an app is autofill. Even the one-time confirmation code from a text message is now automatically transferred into the correct field on phones.
In news reports, the term usually comes up in connection with fraud. Criminals build websites with invisible extra fields that autofill fills in along with the visible ones. The user only sees name and address, but phone number or card details are sent along as well. Experts call this autofill phishing. The protection is simple: don’t store card details permanently, and type manually on unfamiliar sites.
A second recurring topic is the data power of providers. Whoever manages the addresses and payment methods of billions of users knows their purchasing habits. Competition authorities in Europe are therefore examining whether browser and phone manufacturers favor their own payment services during automatic form filling. What was once a harmless convenience feature has thus become a point of contention over market power.