Index: wp-login.php
===================================================================
--- wp-login.php	(revision 40663)
+++ wp-login.php	(working copy)
@@ -22,6 +22,44 @@
 	}
 }
 
+
+/**
+ * Create Password Input Attributes
+ *
+ * @param array   $attributes    Required. Returns attributes for password fields.
+ */
+function password_input_attributes( $attributes ) {
+
+    // Set up an array of defaults for password fields
+    $password_input_attributes = array(
+        'name'          => '',
+        'id'            => '',
+        'class'         => 'input',
+        'value'         => '',
+        'size'          => '20',
+        'autocomplete'  => 'off',
+    );
+
+    // Merge the attributes for a specific password field
+    $password_input_attributes = array_merge( $password_input_attributes, $attributes );
+
+    // Allow filtering of the attributes array
+    if ( has_filter( 'wp_password_input_attributes' ) ) {
+
+    	$password_input_attributes = apply_filters( 'wp_password_input_attributes', $password_input_attributes );
+
+    }
+
+    $html = " ";
+
+    // Create a sanitized string of attributes and values
+    foreach( $password_input_attributes as $attribute_name => $attribute_value ) {
+        $html .= sanitize_key( $attribute_name ) . '="' . esc_attr( $attribute_value ) . '" ';
+    }
+
+    return $html;
+}
+
 /**
  * Output the login page header.
  *
@@ -358,7 +396,7 @@
 
 	/**
 	 * Filters the message body of the password reset mail.
-	 *
+	 * 
 	 * If the filtered message is empty, the password reset email will not be sent.
 	 *
 	 * @since 2.8.0
@@ -438,7 +476,6 @@
 		exit();
 	}
 
-	require_once ABSPATH . WPINC . '/class-phpass.php';
 	$hasher = new PasswordHash( 8, true );
 
 	/**
@@ -634,7 +671,8 @@
 
 		<div class="wp-pwd">
 			<span class="password-input-wrapper">
-				<input type="password" data-reveal="1" data-pw="<?php echo esc_attr( wp_generate_password( 16 ) ); ?>" name="pass1" id="pass1" class="input" size="20" value="" autocomplete="off" aria-describedby="pass-strength-result" />
+				<?php $data_pw = esc_attr( wp_generate_password( 16 ) ) ?>
+				<input type="password" <?php echo password_input_attributes( array( 'name' => 'pass1', 'id' => 'pass1', 'aria-describedby' => 'pass-strength-result', 'data-reveal' => 1, 'data-pw' => $data_pw ) ); ?> />
 			</span>
 			<div id="pass-strength-result" class="hide-if-no-js" aria-live="polite"><?php _e( 'Strength indicator' ); ?></div>
 		</div>
@@ -642,7 +680,7 @@
 
 	<p class="user-pass2-wrap">
 		<label for="pass2"><?php _e( 'Confirm new password' ) ?></label><br />
-		<input type="password" name="pass2" id="pass2" class="input" size="20" value="" autocomplete="off" />
+		<input type="password" <?php echo password_input_attributes( array( 'name' => 'pass2', 'id' => 'pass2' ) ); ?> />
 	</p>
 
 	<p class="description indicator-hint"><?php echo wp_get_password_hint(); ?></p>
@@ -904,7 +942,7 @@
 	</p>
 	<p>
 		<label for="user_pass"><?php _e( 'Password' ); ?><br />
-		<input type="password" name="pwd" id="user_pass"<?php echo $aria_describedby_error; ?> class="input" value="" size="20" /></label>
+		<input type="password"<?php echo $aria_describedby_error; ?> <?php echo password_input_attributes( array( 'name' => 'pwd', 'id' => 'user_pass' ) ); ?> />
 	</p>
 	<?php
 	/**
@@ -964,14 +1002,7 @@
 }, 200);
 }
 
-/**
- * Filters whether to print the call to `wp_attempt_focus()` on the login screen.
- *
- * @since 4.8.0
- *
- * @param bool $print Whether to print the function call. Default true.
- */
-<?php if ( apply_filters( 'enable_login_autofocus', true ) && ! $error ) { ?>
+<?php if ( !$error ) { ?>
 wp_attempt_focus();
 <?php } ?>
 if(typeof wpOnload=='function')wpOnload();