this post was submitted on 02 Apr 2026
70 points (100.0% liked)

Privacy

47653 readers
612 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 6 years ago
MODERATORS
 

LLM-generated passwords (generated directly by the LLM, rather than by an agent using a tool) appear strong, but are fundamentally insecure, because LLMs are designed to predict tokens – the opposite of securely and uniformly sampling random characters.

you are viewing a single comment's thread
view the rest of the comments
[–] Melobol@lemmy.ml 14 points 10 hours ago (4 children)
[–] trailee@sh.itjust.works 7 points 8 hours ago

Many password manager generators already do (use the "memorable" type).

[–] eager_eagle@lemmy.world 6 points 9 hours ago

pls don't spread my password around like that

[–] Ephera@lemmy.ml 5 points 8 hours ago* (last edited 8 hours ago) (1 children)

The problem is that in this case, the LLM just naively auto-completes a password from what it knows a password to most likely look like.

It is possible to enable an LLM to call external tools and to provide it with instructions, so that it's likely to auto-complete the tool call instead. Then you could have it call a tool to generate a correct horse battery staple, or a completely random password by e.g. calling the pwgen command on Linux.

But yeah, that just isn't what this article is about. It's specifically about cases where an LLM is used without tool calls and therefore naively auto-completes the most likely password-like string.

[–] Melobol@lemmy.ml 3 points 8 hours ago

I'm kinda interested how nany accounts you could log in with those strings :D

[–] 64bithero@lemmy.world 2 points 9 hours ago

Yes!

QuiltedNematoadNotepad486