Whenever I go to the admin page of my store it shows the password filled in already:
.
A malicious user would only have to guess the user name to gain access.
I checked chrome's saved password and the webstore url is explicitly excluded. How can this behaviour be changed?