To be more specific -- it's a function of the browser, and each browser can handle it as they wish. Some older browsers will re-populate everything (including passwords), others will populate all but passwords, some will save no state at all.

So -- you can't depend on anything. You're better off doing off as others have suggested, and regenerating the form with the info populated as you wish (censoring passwords, etc, as required). This also gives you an opportunity to mark any problem fields that need correction (which is the normal reason for needing to show the populated form with the previous values)

Oh -- and because this is undefined behaviour for the browser -- there are a few browsers that won't cache a POST, so won't reshow you the form, and thus you can't use the back button if the form was generated from a POST request.