If you can’t come up with a secure password by yourself — and don’t use a password manager for that task (which most should) — then you may have come up with the idea of asking AI to give you a hand in generating secure passwords.
Cybersecurity firm Irregular published research on how that turned out for them during tests, and the result is anything but pretty.
When it asked large language models such as Claude, Gemini or GPT to generate secure passwords, it found “predictable patterns in password characters, repeated passwords, and passwords that are much weaker than they seem”.
While individual 16 character passwords looked strong, the researchers soon discovered that generating passwords multiple times would reveal the weaknesses of the approach.
Take Claude Opus 4.6 for example. When asked to generate 50 passwords, the researchers discovered several noticeable patterns:
- Of the 50 passwords, only 30 were unique. One password was repeated 18 times.
- All passwords started with a latter, usually uppercase G,, almost always followed by the digit 7.
- Character choice was very uneven, with some appearing in nearly all passwords and others rarely.
- No repeating passwords in any of the generated passwords.
ChatGPT did not fare much better. It created passwords with strong similarities. Most passwords started with the uppercase letter V, almost half continued with an uppercase Q.
Passwords generated by Gemini showed clear patterns as well. Almost half the passwords started with uppercase K or lowercase k,, usually followed by one of the characters #,, P or 9.
All AIs tested generated predictable passwords, which make it easier for attackers to brute force them. The researchers conclude that “people and coding agents shouild not rely on LLMs to generate passwords”.
Passwords generated through direct LLM output are fundamentally weak, and this is unfixable by prompting or temperature adjustments: LLMs are optimized to produce predictable, plausible outputs, which is incompatible with secure password generation.
Conclusion
Most computer users may want to stick to password managers as the go-to apps when it comes to generating strong passwords. There are free and paid solutions, local and cloud-based, something for every use case out there.
It’s beyond me why anyone would use AI to generate secure passwords when it has been perfectly possible to do without AI.
The only possible reason I could imagine would be if you were to train AI to brute force passwords if such a thing is relevant these days but nonetheless lets just rename the article as such:
“Research: It appears that AI is very bad!”
Maybe is asking AI to generate a password, that is to create pseudo-randomness is somewhat similar to asking a human being, starting by ourselves, to do so: I wouldn’t be surprised that recurrent patterns are initiated by our brains in which interfere many parasites, conscious or not, which bring randomness impossible in terms of statistics.
Why is AI bad at generating secure passwords and why not ask an AI about it? This is what I tempted at Duck AI chat and, even if the whole conversation may appear rubbish to some of us, digging the topic remains maybe a starting point to further intellectual developments of not only the relationship of AI and randomness but also of randomness and intelligence.
I’ve copy/pasted the chat conversation and left it here: [https://is.gd/X8eTpV] (shotrtened url because the original is lengthy).
People seem to think AI is “intelligent” and therefore able to create something unique, but it’s just a computer program that has been fed a vast amount of alpha-numerical data. So when asked a question, it places that data in what to itself appears to be a logical order.
The danger though is that humans risk losing the ability to think for themselves and become too reliant on machines to do the job for them. In that respect, mathematics has become a task best relegated to a calculator for Gen Z since they seem to be incapable of arriving at a calculation in their own heads.
It’s not the AI’s fault, it’s the humans fault. “You must ask the right question”
Please generate a string of random uppercase letters, lowercase letters, numbers, and special characters that is 32 characters long. You may use only the following special characters ! @ # $ % ^ & * ( ) _ + – = { } [ ] | \ : ” ; ‘ , . ? /.