A chatbot made a complicated password. Is that enough to use it?

Appearance does not establish random generation or uniqueness. For an account password, use the generation feature of a suitable password manager.

Do not judge a proposed password only by how complicated it looks. A long string can follow a predictable rule, and a chat reply alone does not establish how the string was generated or whether it has been reused.

What length can and cannot tell you

Our constructed example repeats a seven-character word eight times, producing 56 characters. Counting confirms the length; it does not make that repeated pattern random. We are not publishing a password for readers to copy.

Use a tool intended for credentials

The UK NCSC describes password managers as a way to store separate passwords and generate passwords for individual accounts. Its current guide recommends passkeys where offered; for passwords, keep them strong and unique. Check the manager’s recovery method and compatibility with your devices.

Give AI the rules, not your secret

AI can help explain a site’s stated password requirements without receiving your current password or recovery codes. Our recommendation is to generate the actual credential in the password manager and keep it out of the conversation.

Keep the limits clear

We have not measured any chatbot’s password distribution, tested a manager or audited storage. A promise such as “unique and secure” in a chat response is not the evidence needed to establish those properties.

Published October 14, 2026. Only the length of a deliberately repetitive fictional pattern was checked. No real credential was generated, submitted, saved or changed; no AI service or password manager was tested.

Sources: NCSC · Managing passwords.