Your Password Habits Are Broken — And AI Won’t Fix Them
A plain-English guide to authentication in 2026: what’s changed, what works, and one surprising new reason not to trust AI with your passwords.
The Problem With Passwords Has Always Been Human
Ask someone to pick a random number between one and ten and most people say seven. Ask them to invent a secure password and they’ll start with a capital letter, end with a number, and base it on something memorable — a pet’s name, a birthday, a street they used to live on. Then they’ll use a version of the same password on every other site they have.
This isn’t laziness. It’s just how human memory works. We are pattern-seeking creatures, not random number generators, and our passwords reflect that. The result is that most people’s password hygiene looks something like: Fluffy2008! on their bank, Fluffy2009! on their email, and Fluffy1! on a shopping site they signed up to twelve years ago and forgot about.
Attackers know this. Password-cracking tools are explicitly designed to try predictable patterns first — dictionary words, names, common substitutions (@ for a, 3 for e), and numbers tacked on the end. A password that took you three seconds to think up can be cracked in less time than it takes to make a cup of tea.
The other side of the problem is data breaches. When a company gets hacked, millions of username and password combinations end up for sale on criminal markets. Attackers then try those same credentials on banking, email, and government sites — a technique called credential stuffing. If you reuse passwords, one breach anywhere cascades into a breach everywhere.
What the Experts Actually Recommend Now
Security guidance has shifted meaningfully in recent years. The US National Institute of Standards and Technology (NIST), whose standards underpin most of the world’s cybersecurity policy, has revised its position substantially:
Stop doing: Routine password changes, mandatory complexity rules (uppercase + number + symbol), security questions.
Start doing: Long, unique passwords — one per account — that you never change unless you have reason to believe they’ve been compromised.
The research behind this is straightforward. Forced password changes don’t improve security; they predictably produce weaker passwords, because people under pressure to change something memorable simply increment a number or add a punctuation mark. A password that was Fluffy1! becomes Fluffy2! and everyone — including attackers — knows it.
Length beats complexity
A 20+ character password composed of four random words — something like correct-horse-battery-staple — is exponentially harder to crack than P@ssw0rd! despite the latter looking far more impressive. Each additional character multiplies the number of guesses an attacker needs to make. Complexity impresses password strength meters; length defeats brute-force attacks.
The Electronic Frontier Foundation (EFF) has published “Diceware” word lists for exactly this purpose — you roll physical dice to select truly random words, producing a passphrase with genuine unpredictability. The site useapassphrase.com demonstrates this in real time, showing the estimated time to crack a randomly generated passphrase (typically measured in millions of years). The contrast with a typical human-invented password is stark.
The AI Twist: Turns Out Chatbots Are Just As Bad As Humans
Here’s where things get interesting — and alarming.
It’s tempting to think that if humans are bad at generating random passwords, we could simply ask an AI chatbot to do it instead. Type “generate me a strong 16-character password” into ChatGPT, Claude, or Gemini and you’ll get something that looks exactly right: mixed case, numbers, symbols, no obvious words. G7$kL9#mQ2&xP4!w. Impressive.
Except it isn’t random. Not even close.
A February 2026 study by cybersecurity firm Irregular tested this directly. They prompted Claude (Anthropic’s AI, the model underlying this very tool) 50 times across separate conversations to generate a password. Of the 50 passwords returned, only 30 were unique. The remaining 20 were duplicates — and 18 of those were the exact same string. Tests on OpenAI’s GPT and Google’s Gemini revealed similar patterns. Even when the same experiment was run using an image-generation model — asking it to draw a Post-It note containing a random password — the outputs showed the same structural biases.
The passwords also displayed another telling tell: not one of them contained a repeated character. At first glance that seems reassuring. In reality, it’s a red flag. A truly random password generator has no reason to avoid repeated characters — they occur naturally when sampling from a uniform distribution. The complete absence of repeats is itself a pattern, evidence that the model is following a learned template rather than sampling randomly.
Why does this happen? It comes down to what large language models fundamentally are. An LLM is a prediction engine. It’s trained on vast amounts of text and learns to predict the most statistically likely next word, character, or token given what came before. That is exactly what makes them useful for writing, summarising, explaining, and coding. But it is structurally incompatible with generating random data. Randomness, by definition, requires that each output be independent and uniformly distributed. Prediction, by definition, means favouring the most likely option. The two are opposites.
As the Irregular researchers put it: passwords generated through direct LLM output are fundamentally weak, and this is unfixable by prompting or temperature adjustments. Telling the model to “be more random” doesn’t help, because the model has no access to true randomness — it only has its training distribution.
The practical consequence is serious. Standard password strength meters rated these AI-generated passwords as excellent, some estimating centuries to crack. In reality, Irregular calculated their effective entropy at around 27 bits — compared to the 98 bits expected from a truly random 16-character password. At 27 bits of entropy, a password can be brute-forced in hours on commodity hardware. If an attacker knows the characteristic patterns that different AI models favour (and researchers now do), the search space shrinks further.
This matters beyond individual users. Developers using AI coding assistants to build software increasingly have those assistants quietly generate passwords, API keys, and database credentials. Irregular found examples of AI-characteristic password patterns in public GitHub repositories — real production systems with weak credentials baked in, invisible to any routine code review.
So What Actually Works?
Password managers
A password manager is a secure, encrypted vault that generates truly random passwords using a cryptographically secure pseudorandom number generator (CSPRNG) — the kind of randomness that is genuinely unpredictable, not the statistical mimicry of an LLM. It stores those passwords and fills them in automatically. You remember one strong master passphrase; the manager handles everything else.
The Australian Cyber Security Centre (cyber.gov.au) explicitly recommends password managers. This isn’t niche advice — it’s the mainstream position of government security agencies worldwide.
Established, well-regarded options include Bitwarden (free and open-source), 1Password (paid, popular with families), and the built-in managers inside Apple and Google devices. All of these use proper cryptographic random generation — not language model prediction.
Two-Factor Authentication (2FA)
Even with a strong unique password, 2FA adds a second requirement: typically a code sent to your phone or generated by an app. Enable it on anything important — banking, email, myGov, superannuation.
SMS codes (text messages) are widely available and much better than nothing. Their known weakness is SIM swapping — an attacker convincing your mobile carrier to redirect your number to their device. Carriers have tightened verification, but the attack persists. The stronger option is an authenticator app such as Google Authenticator, Microsoft Authenticator, or Authy. These generate codes locally on your device and are completely unaffected by anything that happens to your phone number.
The hierarchy: authenticator app > SMS > no 2FA. Use whatever level you’re comfortable with and move up the chain when you can.
Passkeys
The newest development — and worth paying attention to, because major services including Google, Apple, Microsoft, and Australian banks are rolling them out now.
A passkey replaces your password entirely. When you create one, your device generates a pair of cryptographic keys. The private key never leaves your device. The website holds the public key, which is useless without its pair. To log in, you authenticate with your fingerprint, face, or device PIN — nothing is transmitted across the internet that can be intercepted or phished. There is nothing for a website breach to expose.
If a site asks whether you’d like to set up a passkey, it’s worth saying yes.
The Practical Summary
The theme running through all of this is that the weakest link in authentication is usually the human — whether that’s a person reusing a memorable password, or, as it turns out, an AI being asked to fake randomness it cannot produce.
The defences are well-established and not especially complicated:
- Use a password manager to generate and store truly random, unique passwords. This solves the problem at the root.
- Use 2FA on your most important accounts. An authenticator app is better than SMS, but SMS is better than nothing.
- Accept passkeys when they’re offered — they’re the most secure option currently available to ordinary users.
- Don’t ask an AI chatbot to generate passwords for you. The output looks strong; the entropy is not.
Useful resources: cyber.gov.au for Australian-context guidance, haveibeenpwned.com to check whether your email has appeared in a known breach, useapassphrase.com to understand why passphrase length matters, and eff.org/dice for the EFF Diceware method of generating truly random passphrases.
Sources: Irregular Security, “Vibe Password Generation: Predictable by Design” (February 2026); NIST SP 800-63B; Australian Cyber Security Centre; EFF Diceware.
About the featured image: “servans secreta tutum” is the motto of the 692nd Cyberspace Operations Squadron of the US Air Force and translates to “Keeping Secrets Safe” or “Guarding Secrets Secure”.
The image shows a flag, a coat of arms, a seal or some other official insignia produced by the United States Army Institute of Heraldry. It is in the public domain.