Autofill grouping treats all *.nsw.gov.au sites as one organisation

Forum|Forum|29 days ago
August 16, 2026
3 replies
1 view

I'm in Australia, where essentially every government service sits under a state-level suffix: service.nsw.gov.au, revenue.nsw.gov.au, myetoll.transport.nsw.gov.au, and hundreds of unrelated health, education and transport agencies. The same pattern applies to vic.gov.au, qld.gov.au, and so on.

With the default "Fill anywhere on this website" behaviour, 1Password appears to collapse these to a common base domain and suggests every credential I hold under nsw.gov.au on every one of those sites. On a toll-road login I was just offered a credential saved for a hospital system. These organisations have no relationship to each other whatsoever.

The relevant point: nsw.gov.au (and the other state suffixes) are listed on the Public Suffix List as effective TLDs. Grouping beneath them is equivalent to grouping everything under .com. If the matching logic is resolving to gov.au rather than honouring the more specific PSL entry, that looks like a bug rather than a design decision.

Two things would fix this for Australian users:

1. Honour the full PSL entry when determining the registrable domain, so service.nsw.gov.au and revenue.nsw.gov.au are treated as separate sites.
2. Failing that, allow "Only fill on this exact domain" to be set as a default, or applied to all items under a given domain. Currently it is per-item, per-URL-field, with no bulk or CLI option, which means correcting an imported vault is entirely manual.

macOS

Pinned Reply By 1P_Dave

Hello @sanderdowund! 👋

Thanks for reporting this. I checked the current Public Suffix List and nsw.gov.au is not an active entry. It appears only as a commented historical entry, while gov.au is active. nsw.gov.au was previously an active rule and was commented out to respect the request of a representative of the subdomain in question: https://bugzilla.mozilla.org/show_bug.cgi?id=547985

As a result, hosts such as service.nsw.gov.au and revenue.nsw.gov.au share nsw.gov.au as their domain. That explains why separate NSW services can appear together in autofill suggestions. It doesn’t mean those services belong to the same organization.

1Password’s default autofill behaviour uses effective top-level domain plus one, or eTLD + 1, based on the Public Suffix List and additional rules. To limit a login to a single service, add the website address to your Login item and choose Only fill on this exact host: Change where a login is suggested and filled

-Dave

1P_Dave

1Password Employee

Hello @sanderdowund! 👋

Thanks for reporting this. I checked the current Public Suffix List and nsw.gov.au is not an active entry. It appears only as a commented historical entry, while gov.au is active. nsw.gov.au was previously an active rule and was commented out to respect the request of a representative of the subdomain in question: https://bugzilla.mozilla.org/show_bug.cgi?id=547985

As a result, hosts such as service.nsw.gov.au and revenue.nsw.gov.au share nsw.gov.au as their domain. That explains why separate NSW services can appear together in autofill suggestions. It doesn’t mean those services belong to the same organization.

1Password’s default autofill behaviour uses effective top-level domain plus one, or eTLD + 1, based on the Public Suffix List and additional rules. To limit a login to a single service, add the website address to your Login item and choose Only fill on this exact host: Change where a login is suggested and filled

-Dave

S

sanderdowundAuthor

Thanks Dave, that's helpful. I did go and have a look at the list itself. I don't fully follow how it all works, but I noticed NSW has been taken out while most of the other states are still in there:

gov.au
// act.gov.au - Bug 984824 - Removed at request of Greg Tankard
// nsw.gov.au - Bug 547985 - Removed at request of <Shae.Donelan@services.nsw.gov.au>
// nt.gov.au - Bug 940478 - Removed at request of Greg Connors <Greg.Connors@nt.gov.au>
qld.gov.au
sa.gov.au
tas.gov.au
vic.gov.au
wa.gov.au

If I've understood you correctly, that means someone in Victoria or Queensland gets tidy autofill on their government logins and I don't — because NSW was removed at one person's request, while the states nobody wrote in about were left alone.

I've no idea what the reasoning was back then, and the ticket doesn't say. But that was 16 years ago, and the number of NSW services sitting under that address since then has grown enormously — Service NSW, Revenue NSW, transport, the health districts, and plenty more. Whatever the original intent was, it's hard to imagine it still holds up across all of them.

You mentioned 1Password uses this list along with some rules of its own. Is adding NSW, ACT and NT to those rules something that's possible? It would only bring them in line with the states that already work properly.

Either way I can set things per item in the meantime — just thought it was worth raising, since it affects everyone here with government logins saved.

1P_Dave

1Password Employee

@sanderdowund

Thanks for the reply. I recommend raising this with the owners of those subdomains. They can request that the subdomains be added to the Public Suffix List, after which 1Password will recognize and apply those rules as well.

In the meantime, the best available workaround is to select “Only fill on this exact host.”

-Dave

Sign up

1Password employees: Sign in with SSO

Login to the community

1Password employees: Sign in with SSO