TextExpander and Secure Input
TL;DR (too long, don’t read)
First, quit and re-launch Chrome. If a website requests a password while Chrome is in the background, that can lead to incorrect reporting of the app which has enabled secure input. This happens to us all the time with our online accounting software. (We’ve filed bugs with Apple and the Chromium project on the topic.)
If that doesn’t sort it, please read on…
How TextExpander Works
TextExpander expands snippets in response to what you type. But when you are typing a password or entering other sensitive information, a feature called Secure Input ensures that TextExpander—along with other applications—can’t see what you’re typing.
Normally, Secure Input is a good thing; you wouldn’t want TextExpander or any other applications to see your passwords. Secure Input is usually turned off as soon as you leave the password field or sensitive information area. But sometimes Secure Input will stay enabled even after you are finished typing sensitive information. In such cases, TextExpander will stop functioning until Secure Input is disabled.
How Secure Input Can Cause a Problem
As you type characters on your keyboard, they pass through parts of OS X and are usually handed to the active application. There, they will appear on the screen as parts of words, or they might be treated as commands, or they’ll be handled some other way. Applications such as TextExpander can register to see characters that you type, and even modify them, before the active application receives them. This observation of your typing is called key logging, and it is how TextExpander knows that you have typed an abbreviation that should be expanded into its snippet.
Any application can prevent key logging by enabling Secure Input. With Secure Input enabled, all typing is passed directly to the active application—no other applications can observe your typing. This way, Secure Input ensures that no malicious key-logging software or “spy-ware” will be able to see your sensitive data.
Secure Input is generally enabled when you type into a password field. 
Some applications also enable Secure Input at other times, which is appropriate as long as they turn Secure Input off once it is no longer required. Apple has published a technical note which specifies how and when Secure Input should be turned on and off.
How to Fix It
Unfortunately, there are a few situations where Secure Input is left in its “enabled” state when it should not be—when you have finished entering sensitive information, or when you have begun to use a different application than the one that turned on Secure Input. In these cases, you will not be able to use TextExpander until Secure Input is disabled. So how can you disable Secure Input?
TextExpander will let you know when Secure Input is enabled by updating its menu bar item to indicate that expansion is disabled. If the application enabling Secure Input is not the current application, TextExpander adds a “caution” symbol to its menu bar icon and Dock icon. (TextExpander checks Secure Input status about every 15 seconds, so the icon display may lag a bit behind the actual state.) While the menu icon displays as disabled, the “Secure Input enabled by (app name) / Secure Input Prevents Expansion…” menu item indicates which application appears to have enabled Secure Input. Quitting that application will disable Secure Input, allowing TextExpander to function again.
Work-around
In some cases you can avoid Secure Input remaining enabled if you turn off any auto-submit feature of an auto-login that you are using.
Instead, once you fill the password field, or your auto-login fills the password field, click whatever “Login” or “Submit” button is provided along with the password rather than pressing the Return key on your keyboard.
However, depending on the individual application, there may be other ways to avoid this problem. If you’ve having trouble with an app enabling “Secure Input” or getting the “Expansion Disabled” message, check to see if the app you’re having trouble with is listed here. If it’s not, please let us know so we can investigate.
Known Issues by Application
Box
The Box Sync application leaves Secure Event Input enabled after you log in. Quitting Box Sync and starting it again solves the problem. (As of January 2014).
Chronories
Chronories enables Secure Input whenever it is active, but expansion is disabled only within Chronories. We don’t know if there is an option to turn this off.
Fluid
Fluid enables Secure Input and never disables it when a password field is focused while submitting a form. Focusing on another field or removing the focus works around the issue. The Fluid author is aware of the problem and hopes to fix it in a future update.
Game Center
After logging into Game Center within a game application, GameKit can incorrectly leave Secure Event Input enabled afterwards. We have filed a bug with Apple regarding this problem.
Work-around: Launch Activity Monitor, an app found in the Utilities folder of Applications. Locate Game Center in the Process Name list, select it, click the X “stop sign” button at the top left of the window, and choose “Force Quit” to force GameKit to exit, disabling Secure Event Input. (As of February, 2015)
Google Chrome
Chrome sometimes fails to turn Secure Input back off after typing in a password field, particularly if the cursor is still in a password field when the password is submitted. If you find a specific sequence of events that causes this problem, please let us know, and let the Google Chrome team know so they can reevaluate this behavior. A quit and restart of Chrome will restore TextExpander.
Hulu Desktop
Hulu Desktop currently enables Secure Input as soon as it is launched, and leaves it enabled until you quit. Your television viewing habits are probably not a secret! We encourage you to contact Hulu so they can fix this.
iFinance
iFinance enables Secure Input at launch and never disables it. You might offer feedback to the developer that this is not how to use Secure Input properly.
loginwindow
When TextExpander tells you the name of the application that has enabled secure input, it’s giving you a “best guess” that is sometimes inaccurate. When TextExpander reports that “loginwindow” has enabled secure input, it’s likely that TextExpander can’t quite tell which application has enabled secure input, so instead it’s showing that application’s “ancestor, ” loginwindow. This can also happen when macOS itself has left secure input enabled after you’ve logged in, or after you’ve entered your password to wake the computer from sleep. If it is the lock screen causing the problem, then locking your Mac (Apple Menu > Lock Screen) and then logging back in often helps. Once in a while it is necessary to restart your Mac in order to clear the secure input block and re-enable TextExpander. If it is not the loginwindow, try quitting your other running apps. Once the offending app is quit, TextExpander will immediately re-enable. You can use this to determine which app is leaving secure input enabled.
Notational Velocity
The Notes portion of Notational Velocity’s preferences has an option for “Secure Text Entry.” This enables Secure Input while editing within Notational Velocity. Turn this off to permit the use of TextExpander within Notational Velocity. Newer versions only enable Secure Input while Notational Velocity is active, but older versions left Secure Input on until you Quit.
Quicken Scheduler
This application automates acquisition of financial data for Quicken. For some reason, it enables Secure Input. You can run the Activity Monitor utility and quit Quicken Scheduler, or if you disable all “Scheduled Updates” in Quicken, Quicken Scheduler will quit.
Terminal
Terminal has a “Secure Keyboard Entry” menu item so you can turn Secure Input on and off within Terminal. You should probably enable this when entering passwords. Turn it off again afterwards to enable TextExpander expansion.
Other terminal applications such as iTerm2 have similar settings.
Webroot SecureAnywhere
Webroot SecureAnywhere turns on secure input and leaves it on by default. To turn it off, choose “Pause Secure Keyboard Entry” from the Webroot SecureAnywhere menu item.
Word
Word can leave on Secure Input after signing into a Microsoft account. Restarting Word should remove the Secure Input block.