Autotype is a bit risky because it assumes you've got the correct window/element focused. All it takes to expose your passwords is for a pop-up (e.g. instant message) to appear at the right moment.

Even if you don't hit the enter key/submit the form it is still possible for that incorrect window/app to grab your keystrokes.