Display an empty password field
We have a client who runs a security scan that flags login forms that have autocomplete enabled, and have been using this solution for a few years now:

/**
 * Implements hook_form_alter().
 *
 * Remove autocomplete from all user forms.
 * Based on http://www.midwesternmac.com/blogs/jeff-geerling/disabling-autocomplete-forms
 */
function MYMODULE_form_alter(&amp;$form, &amp;$form_state, $form_id) {
  if (strpos($form_id, 'user_') === 0) {
    $form['#attributes']['autocomplete'] = 'off';
  }
}