Experts warn AI-generated passwords may expose users to security risks

By Gizem Nisa Demir

ISTANBUL (AA)—Cybersecurity experts warned that AI-generated passwords may pose serious security risks, according to an analysis by cybersecurity firm Irregular.

ITPro reported on Thursday that the study by Irregular found popular chatbots, including ChatGPT, Claude, and Google Gemini, often produce predictable patterns instead of truly random passwords.

Testing revealed repeated outputs and limited variation; one Claude-generated password appeared 18 times. “Nearly all passwords begin with a v, and among those, almost half continue with Q,” Irregular said, highlighting “strong regularities” in GPT-5.2 results.

Password strength is measured by entropy, or unpredictability. While a secure 16-character password should reach about 98 bits of entropy, AI-generated versions averaged roughly 27 bits, making them easier to crack, researchers said.

Kevin Curran, an Institute of Electrical and Electronics Engineers (IEEE) senior member and cybersecurity professor at Ulster University, called reliance on AI for passwords a “risky practice.”

“These models often produce strings, which appear strong and complex but are actually highly predictable,” he said, adding they “do not generate true randomness.”

Experts advise using password managers, passkeys, and multi-factor authentication instead.