A method and system for password mediation including receiving, within an operating system network stack of a client device, a hypertext transfer protocol (HTTP) request message issued by a client application executing on the client device, the HTTP request message indicating an operation to be performed for a user of the client application at a destination system; requesting, by the client device, security information for the user with respect to the destination system; modifying, by the client device, the received HTTP request message to include the security information; and sending, by the client device, the modified HTTP request message to the destination system.