In summary:
- Security experts warn against using AI-generated passwords after finding predictable patterns in outputs from ChatGPT, Gemini, and Claude that make them vulnerable to attacks.
- PCWorld reports that AI models create probability-based passwords with common structures, like starting with uppercase ‘G’ and using specific characters, with one password appearing 18 times.
- Experts recommend using randomized password generators in password managers instead, as AI-generated passwords lack true randomness and cannot withstand brute-force attacks effectively.
Choosing a secure password isn’t always easy. That’s why some people are turning to “artificial intelligence” (e.g., chatbots like ChatGPT and Google Gemini) to create secure passwords for them.
But security experts at Irregular warn against this approach. After some tests, they’ve discovered that passwords created using “AI” are very easy to crack, even if they appear secure at first glance.
The fatal flaw of AI-generated passwords
The reason for this is simple: all LLM-based AI models fundamentally operate on probabilities. In the same way that AI-generated text and images are made via probability-based functions, AI-generated passwords are also probability-based. Or in other words, such passwords are created using data based on already-known passwords and formulated to find passwords that are “probably secure.”
As such, AI-generated passwords are anything but random. The experts noticed that AIs tend to place certain characters and strings in the same (i.e., predictable) positions. As if that weren’t bad enough, the passwords often began with similar characters and strings, and generally showed little variation in the numbers or letters chosen.
A few examples from the report:
- All generated passwords began with a letter, usually in uppercase. The letter
Gappeared especially frequently. - The characters
L,9,m,2,$, and#appeared in all generated passwords, while some letters were never used. - None of the passwords contained duplicate characters, which would have to happen at some point with a truly random selection. AIs assumed passwords would otherwise not look “random enough.”
- Some passwords were repeated, meaning that only 30 of the 50 generated passwords were truly new.
- The most common password was
G7$kL9#mQ2&xP4!w, which was generated a total of 18 times.
The conclusion? Not only are AI chatbots unable to generate random passwords, but the passwords they generate are severely vulnerable. The AI-generated passwords aren’t even secure enough to withstand a simple brute force attack. These issues were present in all AI models examined, including ChatGPT, Gemini, and Claude.
The risks and consequences are real
According to the security experts, the idea of creating passwords using AI chatbots already has real-world consequences. They were able to discover some of the patterns spotted in AI passwords in open-source code on developer platforms such as GitHub.
These easily recognizable patterns pose a serious security risk. Hackers could exploit them to launch targeted attacks on applications. But it’s not just developers who are at risk, but also real-world users who decide to create their passwords using AI chatbots.
Experts advise against this, warning of the dangers of placing too much trust in AI. Some chatbots (such as Gemini) now also display warnings that you should not use passwords generated with the help of AI, partly because they are processed via servers.
The takeaway: You can only create truly secure passwords using genuine, randomized password generators. These are often already integrated into password managers. Get started with one of our picks for the best password managers to make sure your passwords are safe.
This article originally appeared on our sister publication PC-WELT and was translated and localized from German.
Author: Laura Pippig, Staff Writer, PC-WELT
Laura is an enthusiastic gamer as well as a movie and TV fan. After studying communication science, she went straight into a job at PCMagazin and Connect Living. Since then, she has been writing about everything to do with PCs and technology topics, and has been a permanent editor at our German sister site PC-WELT since May 2024.