Ligatures do not change the value of the text field, just the visual representation of that text. Unicode does not even have a distinct character for the "st" l

Ligatures do not change the value of the text field, just the visual representation of that text. Unicode does not even have a distinct character for the "st" ligature, and not all fonts include a glyph for it either. This is why the text is fine when you paste it elsewhere; the text includes the individual characters "s" and "t", and the app you pasted it into may request that it be rendered without ligatures. I think it's much more likely that you really did just forget your password. There are tools you can use to view the actual HTTP request sent by the browser, if you really want to take the time to set them up. Most desktop browsers also include built-in tools for viewing this traffic, which would make it easier to check.