Automatic strong passwords
When iCloud Keychain is enabled, iOS, iPadOS, macOS, and visionOS create strong, random, unique passwords when users sign up for or change their password on a website in Safari. Automatic strong password generation is also available in apps. Users must opt out of using strong passwords. Generated passwords are saved in the keychain and kept up to date across devices with iCloud Keychain, when it’s enabled.
By default, passwords generated are 20 characters long. They contain one digit, one uppercase character, two hyphens, and 16 lowercase characters. These generated passwords are strong, containing 71 bits of entropy.
Passwords are generated based on heuristics that determine whether a password-field experience is for password creation. If the heuristic fails to recognize a context-specific password being used at password creation, app developers can set UITextContentType.newPassword
on their text field and web developers can set autocomplete= "new-password"
on their <input> elements.
To help ensure that generated passwords are compatible with the relevant services, apps and websites can provide rules. Developers provide these rules using UITextInputPasswordRules
or the passwordrules
attribute on their input elements. Devices then generate the strongest password they can that fulfills these rules.