diff --git a/admin/auth_config.php b/admin/auth_config.php
index e1a0fb08c8c..0c955f48050 100644
--- a/admin/auth_config.php
+++ b/admin/auth_config.php
@@ -64,6 +64,8 @@ echo "<form id=\"authmenu\" method=\"post\" action=\"auth_config.php\">\n";
 echo "<div>\n";
 echo "<input type=\"hidden\" name=\"sesskey\" value=\"".sesskey()."\" />\n";
 echo "<input type=\"hidden\" name=\"auth\" value=\"".$auth."\" />\n";
+// HACK to prevent browsers from automatically inserting the user's password into the wrong fields.
+echo prevent_form_autofill_password();
 
 // auth plugin description
 echo $OUTPUT->box_start();
diff --git a/files/renderer.php b/files/renderer.php
index e878fa63437..7060a677607 100644
--- a/files/renderer.php
+++ b/files/renderer.php
@@ -1015,7 +1015,10 @@ class core_files_renderer extends plugin_renderer_base {
                     <label class="control-label"></label>
 
                     <div class="controls"><select></select></div>
-                </div>
+                </div>';
+        // HACK to prevent browsers from automatically inserting the user's password into the wrong fields.
+        $rv .= prevent_form_autofill_password();
+        $rv .= '
                 <div class="fp-login-input control-group clearfix">
                     <label class="control-label"></label>
                     <div class="controls"><input/></div>
diff --git a/repository/filepicker.php b/repository/filepicker.php
index 4ce0236020a..e488e3d4d41 100644
--- a/repository/filepicker.php
+++ b/repository/filepicker.php
@@ -272,6 +272,8 @@ case 'sign':
         echo '<form method="post">';
         echo '<input type="hidden" name="action" value="sign" />';
         echo '<input type="hidden" name="repo_id" value="'.s($repo_id).'" />';
+        // HACK to prevent browsers from automatically inserting the user's password into the wrong fields.
+        echo prevent_form_autofill_password();
         $repo->print_login();
         echo '</form>';
     }