How to Create a Strong Password AI Can't Crack: 7 Tips (2026)

To create a strong password that AI can't guess, let your Mac make it: Safari and the Passwords app generate a random 20-character password and save it for you. If you have to remember one, use four to seven unrelated random words. Make every password unique, at least 15 characters long, and add a passkey or second factor wherever a site offers one.

The worry is reasonable. Password-guessing tools now learn from leaked passwords, so the clever twist you added to your dog's name is exactly the kind of thing they've seen before. On a Mac, though, the fix takes less effort than the old rules ever did. Below are seven tips, each tied to what NIST, CISA and Apple actually say, plus the steps to clean up the passwords you already have.

What "a password AI can't crack" really means

A password that AI can't crack is one with no human pattern in it. AI-assisted guessing works by learning how people build passwords and then producing likely guesses. In the PassGAN research paper, for example, a neural network trained on real leaked passwords learned their structure well enough to beat rule-based guessing tools on large test sets.

That tells you where the weak spot is. A model can learn that people capitalize the first letter, put the year at the end and swap an "a" for "@". It can't learn anything from a string a random generator produced, because there's nothing to learn. So the goal isn't a cleverer password. It's one you didn't choose.

No password is uncrackable in every situation. If a site stores passwords badly, or you type yours into a fake login page, length won't save you. That's why tip 7, on passkeys and second factors, carries as much weight as tip 1.

1. Let Safari or the Passwords app generate it

The strongest password for most accounts is one your Mac creates. According to Apple's Platform Security guide, passwords generated by macOS are 20 characters long by default, with one digit, one uppercase letter, two hyphens and 16 lowercase letters, and Apple puts their strength at 71 bits of entropy. They're saved to your keychain and sync to your other Apple devices through iCloud Keychain.

In Safari, when you sign up for a site

1. Open the sign-up or change-password page in Safari.
2. Click the password field. With iCloud Keychain on, Safari usually offers a strong password right away.
3. If it doesn't, click the AutoFill key button in the field and choose Suggest New Password, as Apple's Safari guide describes. The suggested password shows with a yellow background.
4. Finish signing up. The password is saved to the Passwords app automatically.

In the Passwords app, for anything else

1. Open the Passwords app (macOS Sequoia or later).
2. Choose All from the sidebar, then the New Password button.
3. Enter the website or app and your user name.
4. Click the Password field and choose Strong Password, or Without Special Characters for a site that rejects symbols.
5. Click Save. Apple's steps are the same for app accounts.

If Safari never offers a suggestion, open Passwords > Settings and check that Suggest Strong Passwords is turned on (Apple lists the setting here). Also check Safari > Settings > AutoFill and make sure User names and passwords is selected.

These days, signing up for anything new, I don't even read the suggestion. I click it, let it save, and move on. The only thing I check is that the site really took the hyphens, because one store login of mine once failed until I regenerated it without special characters.

2. Go long: 15 characters at the very least

Length does more for a password than any mix of symbols. NIST's current digital identity guidelines, SP 800-63B, say a password used on its own should be at least 15 characters, and that services should accept at least 64. CISA's advice for everyday users is at least 16 characters, with the note that longer is stronger.

NIST also tells services to stop forcing composition rules, such as demanding an uppercase letter, a number and a symbol. I've watched those rules produce the same tired result again and again, something like "Summer2026!", which is exactly the kind of pattern a trained guesser expects. A site may still ask for them, and that's fine: Apple's generated passwords already include a digit and an uppercase letter.

3. Need to remember it? Use random, unrelated words

For the handful of passwords you type from memory, a passphrase of random words works better than a short scramble. CISA suggests a phrase of 4 to 7 unrelated words, and the UK's National Cyber Security Centre recommends combining three random words while avoiding birthdays, family and pet names, which are often on your social profiles.

The word that matters is random. A line from a song, a movie quote or your street and your kid's name all read as phrases to a model trained on human writing. Pick words that have nothing to do with each other or with you, and string them together with spaces or hyphens if the site allows it. NIST says services should accept spaces, so a phrase like "lantern velvet orbit cabbage pier" is a fair shape to aim for, as long as you don't use that exact one.

I keep only a few of these in my head: my Mac's login password, my Apple Account password and the one for my main email. Everything else lives in the Passwords app, so I never have to invent a fourth.

4. Give every account its own password

A unique password for each account stops one leak from turning into ten. The NCSC puts it bluntly: criminals only need one password to get into accounts that share it, and your email deserves its own because whoever controls your inbox can reset everything else.

Your Mac watches for this. Apple's security guide says the Passwords app marks a password as reused when the same one is saved for different domains. If you've been carrying one favorite password across sites for years, the Security list in the Passwords app will show you exactly where.

5. Skip the patterns guessers try first

Some passwords are weak no matter how long they look. Apple flags a password as weak when it relies on common dictionary words, simple character substitutions, keyboard patterns or repeated sequences, and NIST tells services to block passwords found in breach lists, dictionaries and context words such as the site's own name or your user name.

Password hints are on the way out too. NIST says services shouldn't offer hints that anyone can see before signing in, or ask security questions when you choose a password, so don't spend effort crafting a hint that gives the game away.

6. Change a password when there's a reason, not on a schedule

You don't need to change strong passwords every 90 days. NIST now says services shouldn't require periodic changes, and should force a change only when there's evidence a password has been compromised. A forced schedule rarely makes anything stronger; it tends to get you "Password1", then "Password2".

A real reason looks like this: the site announced a breach, the Passwords app warns that a password appeared in a leak, you typed it into a page you no longer trust, or you shared it with someone who shouldn't have it anymore. Turn on the warning in Passwords > Settings > Detect Compromised Passwords so your Mac tells you when it happens.

How to fix weak or leaked passwords already on your Mac

The Passwords app lists every weak, reused or leaked password in one place, and fixing them takes a few clicks each. These are Apple's steps:

1. Open the Passwords app and click Security in the sidebar.
2. Click an account. A message explains what's wrong with its password.
3. Click Change Password to open the site, then set a new password there. Let Safari suggest it.
4. If the site offers a passkey or Sign in with Apple, Apple recommends using that instead.
5. For a recommendation you can't act on, such as an old account you can no longer reach, select it and click Hide.

Start with the ones marked as compromised, then your email, bank and Apple Account, then work down the list over a few days. The first time I opened that Security list, I closed it again and came back the next morning with coffee. A handful a day got me through it without dreading it.

7. Add a second factor, or skip the password with a passkey

A strong password protects you from guessing. A second factor or a passkey protects you when the password itself gets stolen. CISA explains that with multi-factor authentication, someone who steals your password still can't meet the second step.

Store verification codes in the Passwords app

Apple says the Passwords app can set up and store automatic verification codes, so you don't need text messages or a separate authenticator app. Turn on two-factor authentication in the site's own security settings, and when it shows a setup code, add it to that account in Passwords.

Switch to a passkey where a site offers one

A passkey replaces the password entirely. Apple describes it as a way to sign in without creating or remembering a password, using Touch ID or Face ID instead, and each passkey is stored in iCloud Keychain. The FIDO Alliance, which wrote the standard, says passkeys are always strong and phishing-resistant. There's nothing to guess, nothing to reuse and nothing to type into a fake page.

1. On a site that supports passkeys, go to its sign-up page or its account security settings.
2. Choose to create or add a passkey.
3. When your Mac offers to save it, confirm with Touch ID, or choose Other Options to use an iPhone, iPad or security key.
4. The passkey now appears in the Passwords app alongside your passwords.

If you want your Mac to do this for you, Passwords > Settings > Automatically Create Passkeys lets sites and apps upgrade your accounts to passkeys when they support it.

Which kind of sign-in to use for which account

You'll likely use all three: generated passwords for nearly everything, a few memorized passphrases, and passkeys wherever they're offered.

Where not to put a password

A strong password is only as safe as the places it's been. A few habits undo all the work above:

• An AI chat. Don't paste passwords, recovery codes or verification codes into ChatGPT or any other assistant, even to ask for help with a login problem. Our guide to whether ChatGPT is safe covers what those apps keep.
• A note or spreadsheet. A file called "passwords" in Notes or on your desktop is the first thing anyone with access to your Mac would open. Move the entries into the Passwords app and delete the file.
• An email or message. If you need to give someone access, use File > New Shared Group in the Passwords app to share selected passwords and passkeys with people in your Contacts instead.
• A login page you reached from a link. If an email says your account is locked, open the site yourself. A passkey won't work on a fake site, which is one more reason to set them up.

If your email password is the one that needs changing first, our step-by-step guide to updating an email password on a Mac covers Gmail, iCloud, Outlook and Yahoo, and how to stop Mail asking for the old one. For Gmail specifically, see how to use Gmail securely on a Mac.