Last week a client asked me a really fair question: "Can't I just have ChatGPT generate strong passwords for my team? It would save me so much time."
I get why people ask. We're seeing AI used for everything right now across our client base, from drafting emails to writing job descriptions to building spreadsheets. So if it can do all that, why not have it spin up a 16-character password with symbols and numbers?
Here's why I had to gently talk her out of it.
Researchers recently tested the major AI tools by asking them to generate secure passwords. On the surface, the results looked great. Long strings of mixed-case letters, numbers, and symbols. When they ran those passwords through online password strength meters, they scored highly. Some checkers even estimated it would take centuries to crack them.
But when the passwords were analyzed properly, a very different picture emerged.
AI systems are powered by something called a large language model, or LLM. That means they're trained to predict what text should come next. They're brilliant at producing text that looks natural and plausible. What they are not designed to do is create true randomness.
And strong passwords rely on randomness.
When researchers examined dozens of AI-generated passwords, they found repeating patterns. Some passwords were duplicates. Many followed very similar structures. Interestingly, none of them contained repeating characters.
That might sound like a good thing, but real randomness often includes repetition. The absence of it suggests the password is following learned rules rather than being generated unpredictably.
The researchers measured something called "entropy," which is a technical way of describing how unpredictable something is. AI-generated passwords scored far lower than a genuinely random 16-character password should. That means they could be much easier to crack using a brute-force attack, where attackers try huge numbers of combinations very quickly.
Online password checkers don't catch this because they only look at visible complexity. They see symbols and numbers and assume it's secure. They don't account for the hidden patterns created by AI.
Even newer models like Gemini 3 Pro have started issuing warnings when asked to generate passwords, advising people not to rely on chat-generated credentials for sensitive accounts. That should tell you something.
If you want properly secure passwords, use a password manager with a built-in generator. These use cryptographic randomness, meaning mathematical processes specifically designed to create unpredictable results. It's the right tool for the job.
AI is an excellent productivity tool. We use it. Our clients use it. But when it comes to security essentials like passwords, it's the wrong tool reaching for the wrong thing.
If you're a business owner anywhere along the Georgia, South Carolina, or Florida coast and you're not sure whether your team is doing passwords right, we'd love to help you sort it out. No pressure, no jargon, just a real conversation about what would actually work for your business.