iOS 15 Password Generator Format Explained

Apple’s iOS 15 features an integrated password generator via iCloud Keychain that automatically creates and fills secure, unique credentials in Safari and supported apps. This article examines the default structure of these automatically generated passwords, the rules governing their character composition, and how iOS 15 adapts its formatting dynamically based on website-specific form requirements.

Default Password Structure

When a website does not specify custom password constraints, iOS 15 generates a standardized 20-character password. This default format consists of:

  • Grouping: Four segments of characters separated by hyphens (for example: xK3-mP9-qL2-vR8).
  • Hyphens: Three hyphens act as natural visual separators, improving readability if a user needs to view or manually transcribe the password.
  • Character Variety: Each alphanumeric group contains a mix of uppercase letters, lowercase letters, and digits.
  • Readability Adjustments: The generator minimizes ambiguous characters to reduce confusion when reading the password on screen.

Adaptation to Form-Specific Rules (passwordrules)

Web forms often enforce rigid password requirements, such as requiring special symbols or banning specific characters. iOS 15 addresses this using the passwordrules HTML attribute standard developed by Apple and adopted by web standards bodies.

When an HTML <input> tag contains this attribute, Safari parses the parameters and modifies its output accordingly:

  • Length Constraints: The system automatically adjusts its generated output to satisfy minlength and maxlength properties.
  • Required Characters: If an input specifies required: special;, iOS 15 substitutes standard hyphens or characters with special symbols (such as @, #, or !).
  • Forbidden Characters: If a site restricts certain symbols via allowed lists, the generator excludes those characters to prevent form submission errors.

Security and Usability Balance

The format chosen in iOS 15 balances high entropy with human usability. By dividing the string into hyphenated chunks, the system ensures high cryptographic strength against brute-force attacks while remaining easy for users to verify, read aloud, or type manually on secondary devices if iCloud Keychain sync is unavailable.