(C) BoingBoing
This story was originally published by BoingBoing and is unaltered.
 . . . . . . . . . .



Please do not use AI to generate passwords [1]

['Gail Sherman']

Date: 2026-03-02  

A test of popular Large Language Models reveals that using them to generate passwords yields passwords that appear strong but are actually insecure.

Irregular, an artificial intelligence security lab, analyzed passwords generated by several LLM models and agents and found "predictable patterns in password characters, repeated passwords, and passwords that are much weaker than they seem." One model, Gemini 3 Pro, warned that the passwords it generates are "passed through servers" and "best suited for testing purposes or throwaway accounts." It then generated a "high security" password — with no warning about the fundamental insecurity of using an LLM for this in the first place.

Multiple patterns emerged, including no repeated characters, always starting with a letter, and — worst of all — repeated passwords. In one test, a request for 50 passwords yielded only 30 unique ones. One password was repeated 18 times. Searching for the string at the start of that password turned up numerous instances online, indicating that these insecure passwords are already in use in the wild.

If this reminds you of a classic XKCD comic, Google's Gemini agrees with you. Asking Nano Banana Pro to generate an image of "a post-it note attached to a monitor, with a secure password written on it" produced a lot of post-its with Tr0ub4dor&3 — but not correct horse battery staple.

The full article has more technical details, but the takeaway is simple: do NOT use ChatGPT, Claude, Gemini, or any other LLM to generate passwords. Use a strong password generator, like those included in password managers.

Previously:

[END]
---
[1] Url: https://boingboing.net/2026/03/02/please-do-not-use-ai-to-generate-passwords.html

Published and (C) by BoingBoing
Content appears here under this condition or license: Creative Commons BY-NC-SA 3.0.

via Magical.Fish Gopher News Feeds:
gopher://magical.fish/1/feeds/news/boingboing/