CREDENTIAL FRAGMENTATION

AUTOFILL BYPASS

Attackers split passwords across multiple single-character fields with varied autocomplete attributes. Browsers may autofill each fragment; JavaScript reassembles the full credential server-side.

[ LIVE STAGE ]

Username field (visible decoy):

Password split into 8 hidden single-char fields:

[+] Reassembled: (type or autofill to test)

[*] Fragment fields created. Each uses autocomplete="new-password" to evade heuristics.

Technique: Used to bypass password manager single-field detection. Defenses: block autofill on fragmented inputs, WebAuthn.