Same with password managers inside web browsers: they'll only present the filled-in password for the original domain, not a phishing domain.