diff --git a/lib/form/password.php b/lib/form/password.php
index 1883897edab..c157a47fad6 100644
--- a/lib/form/password.php
+++ b/lib/form/password.php
@@ -15,6 +15,16 @@ class MoodleQuickForm_password extends HTML_QuickForm_password{
      */
     var $_helpbutton='';
     function MoodleQuickForm_password($elementName=null, $elementLabel=null, $attributes=null) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete of passwords
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            $attributes = (array)$attributes;
+            if (!isset($attributes['autocomplete'])) {
+                $attributes['autocomplete'] = 'off';
+            }
+        }
+
         parent::HTML_QuickForm_password($elementName, $elementLabel, $attributes);
     }
     /**
diff --git a/lib/form/passwordunmask.php b/lib/form/passwordunmask.php
index c0e517d2ca9..7210323536e 100644
--- a/lib/form/passwordunmask.php
+++ b/lib/form/passwordunmask.php
@@ -15,6 +15,15 @@ require_once($CFG->libdir.'/form/password.php');
 class MoodleQuickForm_passwordunmask extends MoodleQuickForm_password {
 
     function MoodleQuickForm_passwordunmask($elementName=null, $elementLabel=null, $attributes=null) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete of passwords
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            $attributes = (array)$attributes;
+            if (!isset($attributes['autocomplete'])) {
+                $attributes['autocomplete'] = 'off';
+            }
+        }
         parent::MoodleQuickForm_password($elementName, $elementLabel, $attributes);
     }
 
@@ -25,7 +34,6 @@ class MoodleQuickForm_passwordunmask extends MoodleQuickForm_password {
             return $this->getFrozenHtml();
         } else {
             $unmask = get_string('unmaskpassword', 'form');
-            $this->updateAttributes(array('autocomplete' => 'off'));
             //Pass id of the element, so that unmask checkbox can be attached.
             $PAGE->requires->yui_module('moodle-form-passwordunmask', 'M.form.passwordunmask',
                     array(array('formid' => $this->getAttribute('id'), 'checkboxname' => $unmask)));
diff --git a/lib/formslib.php b/lib/formslib.php
index ca83c7c6001..c426942ef65 100644
--- a/lib/formslib.php
+++ b/lib/formslib.php
@@ -139,6 +139,16 @@ abstract class moodleform {
      * @return object moodleform
      */
     function moodleform($action=null, $customdata=null, $method='post', $target='', $attributes=null, $editable=true) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete with the exception of user signup
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            $attributes = (array)$attributes;
+            if (!isset($attributes['autocomplete'])) {
+                $attributes['autocomplete'] = 'off';
+            }
+        }
+
         if (empty($action)){
             $action = strip_querystring(qualified_me());
         }
diff --git a/lib/javascript-static.js b/lib/javascript-static.js
index 02254220386..07f8cfc6c40 100644
--- a/lib/javascript-static.js
+++ b/lib/javascript-static.js
@@ -920,13 +920,14 @@ function unmaskPassword(id) {
   try {
     // first try IE way - it can not set name attribute later
     if (chb.checked) {
-      var newpw = document.createElement('<input type="text" name="'+pw.name+'">');
+      var newpw = document.createElement('<input type="text" autocomplete="off" name="'+pw.name+'">');
     } else {
-      var newpw = document.createElement('<input type="password" name="'+pw.name+'">');
+      var newpw = document.createElement('<input type="password" autocomplete="off" name="'+pw.name+'">');
     }
     newpw.attributes['class'].nodeValue = pw.attributes['class'].nodeValue;
   } catch (e) {
     var newpw = document.createElement('input');
+    newpw.setAttribute('autocomplete', 'off');
     newpw.setAttribute('name', pw.name);
     if (chb.checked) {
       newpw.setAttribute('type', 'text');
diff --git a/login/signup.php b/login/signup.php
index f3b83be65d3..fb27841c8b3 100644
--- a/login/signup.php
+++ b/login/signup.php
@@ -43,7 +43,7 @@ $PAGE->https_required();
 $PAGE->set_url('/login/signup.php');
 $PAGE->set_context(get_context_instance(CONTEXT_SYSTEM));
 
-$mform_signup = new login_signup_form();
+$mform_signup = new login_signup_form(null, null, 'post', '', array('autocomplete'=>'on'));
 
 if ($mform_signup->is_cancelled()) {
     redirect(get_login_url());