Security

Automatic Strong Passwords

When iCloud Keychain is enabled, iOS, iPadOS, and macOS create strong, random, unique passwords when users sign up for or change their password on a website in Safari. In iOS and iPadOS, Automatic Strong Passwords is also available in apps. Users must opt out of using strong passwords. Generated passwords are saved in the keychain and synchronized across devices with iCloud Keychain, when it’s enabled.

By default, passwords generated by iOS and iPadOS are 20 characters long. They contain one digit, one uppercase character, two hyphens, and 16 lowercase characters. These generated passwords are strong, containing 71 bits of entropy.

Passwords are generated based on heuristics that determine whether a password-field experience is for password creation. If the heuristic fails to recognize a password context as for password creation, app developers can set UITextContentType.newPassword on their text field, and web developers can set autocomplete= “new-password” on their <input> elements.

To ensure that generated passwords are compatible with the relevant services, apps and websites can provide rules. Developers provide these rules using UITextInputPasswordRules or the passwordrules attribute on their <input> elements. Devices then generate the strongest password they can that fulfills these rules.

See alsoPasscodes Function of passwords

Helpful?

Apple Platform Security

Automatic Strong Passwords