Open Autofill Safety Corpus v1

Password-manager autofill is a write decision involving a secret. A useful test contract therefore needs to express not only where a credential may go, but also when the safest answer is no target. Open Autofill Safety Corpus v1 turns that narrow decision into typed, machine-readable fixtures with exact expected element IDs.

Open browser playground Download corpus JSON Download SHA-256 Inspect typed source

SHA-256 d29d8fdfbfe826216efd1118e4326af99559c1c24388e0d8111608c1c2d402a7

What version 1 contains

Every fixture uses small, hand-written markup on a reserved .invalid hostname. No HTML is copied from a real vendor page. A phase records the URL, document language, body markup, expected password classification, optional stored-password target, OTP shape, and ordered OTP targets.

How the contract runs

1. The runner sorts fixtures and phases by stable identifiers.
2. An adapter mounts the synthetic document for one phase.
3. The adapter returns a normalized observation rather than performing a credential write.
4. The runner compares the password kind, password target, OTP kind, and ordered OTP targets exactly.
5. The report contains no clock time, random value, or environment-specific path, so identical observations serialize identically.

Authier’s repository adapter calls the production classifyPasswordForm, findSegmentedOtpInputs, and findSingleOtpInput functions, plus the same pure stored-password target policy used by runtime autofill. The adapter test asserts exact observations without writing a credential. Separate production suites exercise runtime autofill behavior with synthetic values. This page does not publish a dated run report, so it does not present a versioned empirical result, browser-compatibility measurement, or current pass count.

What a passing result does not establish

• No real browser or packaged extension is launched.
• No password or TOTP value is written, submitted, or sent over a network.
• No extension permission, content-script isolation, or hostile page script is exercised.
• No cross-browser, cross-origin frame, closed-shadow-root, localization, or visual-layout behavior is measured.
• No inference can be made about Authier’s overall security, compatibility, or real-world false-positive rate.

Authier remains early-stage and has not published an independent security audit. Its broader security architecture and limitations should be evaluated separately from this classifier artifact.

How this differs from existing work

This is not the first autofill test collection or password-manager study. Mozilla maintains form-fill example pages, while Bitwarden’s Browser Interactions Testing runs static and selected live scenarios with a real extension build. The 2020 USENIX Security paper “That Was Then, This Is Now” evaluated generation, storage, and autofill across 13 password managers. The ACSAC 2024 Leaky Autofill artifact examines whether password managers fill data into concealed fields. The USENIX Security 2026 paper “AutoFail” studies the separate Android boundary where browsers translate web content into the Autofill Framework and evaluates credential filling across browsers and password managers.

Version 1 is intentionally smaller: an adapter-friendly regression contract for form-shape classification, ordered target selection, and explicit abstention. Its value is the narrow boundary, not a claim to replace browser-level or empirical security research.

Next evidence layers

The next useful addition is a packaged-extension integration adapter in a real Chromium context, followed by focused open-shadow-root coverage and synthetic cross-origin-frame cases. Browser engines, localization, hostile scripts, and a measured sample of real form shapes should remain separate result sets so their evidence is not blurred into the deterministic v1 classifier contract.