External Publication
Visit Post

LLMs Generate Predictable Passwords

Schneier on Security [Unofficial] February 26, 2026
Source
LLMs are bad at generating passwords: > There are strong noticeable patterns among these 50 passwords that can be seen easily: > > * All of the passwords start with a letter, usually uppercase G, almost always followed by the digit 7. > * Character choices are highly uneven ­ for example, L , 9, m, 2, $ and # appeared in all 50 passwords, but 5 and @ only appeared in one password each, and most of the letters in the alphabet never appeared at all. > * There are no repeating characters within any password. Probabilistically, this would be very unlikely if the passwords were truly random ­ but Claude preferred to avoid repeating characters, possibly because it “looks like it’s less random”. ... >

Discussion in the ATmosphere

Loading comments...