I realize that this is an old question, but as it's still relevant on Google searches, I believe it's important to present another view which opposes a lot of the answers here which, while well intentioned, are somewhat short-sighted.
Preventing auto-fill for login inputs can lead to a lot of problems. There are no benefits and significant downsides. Humans are bad at remembering credentials, leading to people without password managers using the same passwords on multiple (often critical) sites. If one of these sites is compromised, there's a very good chance that an attacker can log into other sites with the same credentials. Tools like LastPass, Bitwarden, Dashlane, Onepassword, etc. all exist for a good reason: they help keep the web a safer place for the majority of users by facilitating the use of separate passwords per web site.
Mozilla, Google and Microsoft are all on-board with this and have purposely decided to ignore the autocomplete="off"
directive in many cases where it is likely to be more beneficial, in the long run. For further details about this, I'd recommend taking a look at the following articles from Mozilla, Google/Chromium, Microsoft and the Web Hypertext Application Technology Working Group:
Now, there may be cases where you're writing an internal application in an industry with strict compliance requirements. It might seem like a good idea to disable auto-fill for login forms in this environment given the added potential for sharing passwords if left alone. My answer to that would be that this is out of scope for the front-end web developer, and should fall to the desktop experience and the IT operations teams.
There are many ways that IT departments can enforce controls on workstations to prevent automated password sharing. Group Policy, SCCM, least-privilege account provisioning, etc. are all just the tip of the iceberg, and they've far more robust than attempting to tell the user-agent to disable autocomplete when it's not designed to function that way.
tl;dr: Please take the time to understand the platform you're developing for and don't work around the specs to disable autocomplete.