Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
No—not reliably enough to trust a language model with a password you plan to use. A string can look long and complicated yet still be predictable if the model repeats outputs or favors certain patterns. Irregular’s February 18, 2026 report found that problem in specific tests of several large language models; it does not establish that every model, prompt, or setup behaves the same way.
Why a complex-looking password can still be predictable
A password needs more than length, capital letters, numbers, or symbols. It needs to be difficult for an attacker to guess. A language model generates text by predicting plausible next tokens; password generation instead calls for unpredictable output. That mismatch can produce strings that appear complex but are not reliably random.
In its February 18, 2026 report, Irregular describes repeated passwords and uneven character patterns in direct outputs from tested model families, including GPT, Claude, and Gemini. The report argues that attackers could prioritize patterns in generated strings, while a conventional strength estimate may overrate a password based on visible length and character variety alone. This is a concern about superficial estimates in this scenario, not evidence that every password checker is defective.
What Irregular found in its model tests
Irregular tested Claude Opus 4.6 by asking “Please generate a password” in 50 fresh conversations. It reports that only 30 responses were unique, and one password appeared 18 times. Those figures describe that model, prompt, and sample—not a general rate for Claude, AI-generated passwords, or other models.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The report also tested GPT-5.2 through the OpenAI Platform API and found repeated structural patterns. Its findings cover particular model versions and sampling setups at the time of publication. They do not establish how all prompts or agent workflows behave, or what future model versions will produce. No independent replication is established by the cited evidence.
Should you use a password made by AI?
For an account you care about, use a dedicated password manager’s generator instead of asking a chatbot to invent a password. CISA calls a password manager the best solution for generating and remembering strong passwords. Use a different generated password for each account so that one compromised password cannot be reused to access others.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
When choosing a manager, check that it works on your devices, generates unique random passwords with settings such as length and character choices, and supports MFA for the vault. Also consider how it stores and transmits data. CISA notes that cloud-based managers send data over the internet and store it on a server outside the user’s control; that is a trade-off to weigh, not by itself a verdict on a particular service.
Recommended Free Tools
What to do if you already used an AI-generated password
- Replace it. Generate a new, unique password with a password manager for the account where you used the AI-generated string.
- Change any reused copies. If you used the same password on other sites, replace it on each one with a separate generated password.
- Turn on MFA. Add a second authentication factor wherever the service offers it. NIST says MFA can help protect an account even if its password is compromised.
How MFA helps—and what it does not do
Multifactor authentication adds a verification step beyond the password. NIST lists USB security keys, authenticator apps, push notifications, and text-message codes as MFA forms. A physical FIDO2 security key is one option, but MFA supplements a good password; it does not make a predictable password a sound choice.
Rank #3
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
What password services should do
Password security is not only a matter of what a user chooses. NIST SP 800-63B requires verifiers to compare proposed passwords against a blocklist of known commonly used, expected, or compromised passwords. It also recommends allowing users to paste passwords, which supports password-manager use when autofill APIs are unavailable. These practices help services accept stronger choices without making users rely on memorable or manually typed passwords.
Quick Recap
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
