Here’s a quick question: If you needed a secure password for an important account, would you ask an AI tool to create it?
At first glance, that seems like a perfectly sensible idea.
After all, tools such as ChatGPT and Copilot can draft emails, write reports, summarize information, and even help build software. Generating a strong password filled with numbers, symbols, and mixed-case letters sounds like an easy task by comparison.
However, security experts are warning that this may not be the best approach.
Researchers recently evaluated several AI platforms to see how well they could generate secure passwords.
The passwords looked impressive at first. Most were lengthy and included a combination of uppercase and lowercase letters, numbers, and special characters.
When tested using common password-strength checkers, many received excellent ratings. Some were even estimated to take hundreds of years to crack.
But a deeper analysis revealed a potential problem.
AI tools are powered by large language models (LLMs), which are designed to predict patterns in language and generate text that appears natural and convincing.
What they are not designed to do is produce truly random output.
And randomness is one of the most important ingredients of a strong password.
When researchers examined a larger sample of AI-generated passwords, they discovered noticeable similarities between them. Some passwords were repeated, while others followed nearly identical patterns and structures.
One particularly interesting finding was that none of the passwords contained repeated characters.
That might seem like a sign of quality, but genuine randomness often includes repeated letters, numbers, or symbols. The fact that these passwords consistently avoided repetition suggested they were being shaped by learned patterns rather than generated unpredictably.
Researchers also measured the passwords’ entropy, a technical term used to describe how random and unpredictable something is.
The results showed that AI-generated passwords fell well short of the entropy levels expected from a truly random 16-character password.
In practical terms, that means attackers using brute-force techniques could potentially crack them more easily than the password strength scores suggest.
The problem is that most online password checkers only evaluate visible complexity.
They see a mix of characters and assume the password is strong. They don’t measure whether hidden patterns make it more predictable.
Even advanced AI systems, including Gemini 3 Pro, have started warning users against relying on AI-generated passwords for important accounts and sensitive systems.
That alone should raise a red flag.
If you need a secure password, the better option is to use a password manager with a built-in password generator.
These tools rely on cryptographic randomness, specialized mathematical methods designed specifically to produce unpredictable results.
AI can be incredibly useful for improving productivity and streamlining work. But when it comes to something as important as password security, it’s best to leave the job to tools built for that purpose.
Need help selecting a password manager that fits your business? Get in touch and we’ll be happy to help.
