How iOS 16 Safari Generates Strong Passwords

When signing up for accounts or updating credentials on an iPhone, iOS 16 Safari automatically suggests complex, unique passwords to safeguard user accounts. This article explains the technical mechanics behind how iOS 16 generates these strong passwords, including the use of cryptographic randomness, website-specific rule parsing, and the dynamic formatting engine built into Apple's operating system.

Cryptographic Randomness and Entropy

Safari does not rely on simple pseudo-random number generation. Instead, iOS 16 uses low-level, cryptographically secure pseudo-random number generators (CSPRNG) managed by Apple’s Darwin operating system foundation. By sampling hardware entropy sources collected by the device, the system ensures that every character sequence generated is mathematically unpredictable and immune to standard brute-force or dictionary-based guessing attacks.

Default Structure and Formatting

By default, Safari generates a high-entropy string typically consisting of 20 characters. The standard layout presents alternating alphanumeric groups separated by hyphens (for example, xX7-aBc-d9F-kLm). These hyphens do not lower the password's security; instead, they serve two practical purposes:

  • Readability: If a user must manually enter the password on another device, the grouping makes it easy to read and type without errors.
  • Complexity Requirements: The pattern uniformly distributes uppercase letters, lowercase letters, and digits to meet standard web service criteria.

Dynamic Adaptation with Website Rules

In iOS 16, Safari avoids generation failures on restrictive websites by actively parsing site constraints before suggesting a password. Safari examines:

  1. The passwordrules HTML Attribute: Apple introduced the passwordrules standard to web specifications. If a website specifies requirements directly in its HTML (e.g., minlength: 8; maxlength: 16; required: upper, lower, digit; allowed: [-!@#]), Safari reads this metadata and customizes the generated password to fit those exact parameters.
  2. Form Attributes: Safari inspects standard HTML form attributes, such as minlength, maxlength, and input pattern regex fields, to constrain length and character types.
  3. Local Overrides: Apple maintains a heuristics database within Safari that contains compatibility rules for popular domains known to break when standard symbols or lengths are used.

On-Device Processing and Security

All password generation occurs entirely on the local device within Safari and the iOS Secure Enclave architecture. The suggested string is not sent to external Apple servers during generation. Once accepted by the user, the credentials are encrypted end-to-end and saved directly into iCloud Keychain, ensuring the generated password remains accessible across synced Apple devices while staying protected against third-party interception.