We’ll develop a simple password generator Django application using GitHub Copilot agent mode. At the end we’ll analyze the tradeoffs of using LLMs to develop this application. To do this we’ll use the GitHub Copilot plugin for PyCharm, you can do the same thing using VS Code if you want to. I’ll be using GPT-4.1 in this tutorial.

This is the repository that I’ll use to make this project, you can check it if you want to see the final version of this project: https://github.com/santiago177/PasswordGenerator

Requirements

This project will be built using Django and will use GitHub Copilot to generate most of the code, you’ll need the following setup:

• Install Python
• Install Git
• Install PyCharm free version
• A GitHub account

Feel free to skip to the Create a README and AGENTS file section if you feel confident creating a Django project in a GitHub repository and have the GitHub Copilot plugin already.

Creating the project and repository

Open PyCharm and create a new Django project, then name the project PasswordGenerator.

It should look like this:

Commit the boilerplate code and create a new repository for your project in GitHub by going to Git -> GitHub -> Share Project on GitHub.

Get the GitHub Copilot plugin

Go to Settings -> Plugins and type Copilot in the search bar, look for the GitHub Copilot plugin and install it, you’ll need to restart PyCharm afterwards.

Open the GitHub Copilot window on the right side and log in to it using your GitHub account by clicking on Continue with GitHub. You don’t need to get a premium version of GitHub Copilot but you have a limited amount of requests, that limit will be more than enough to complete this project.

You should see a chat window like this if you’re successfully logged in:

Create a README and AGENTS file (Optional)

This is an optional step that helps the agent better understand your project by generating an AGENTS.md file.

Create a README.md file first. I’ll use the following one:

# PasswordGenerator

This is a very simple project designed to generate random passwords.

## Description
The purpose of this project is to provide a basic tool for generating secure and random passwords. It is ideal for those who need to create passwords quickly and easily.

## Features
- Random password generation
- Simple and easy-to-understand code

## Build Mode
This project is intended to be built and managed using **agent mode**, which makes automation and task integration easier.

## Requirements
- Python 3.x

---

This project is ideal as an educational example or as a base for more advanced developments.

Having a readme file has multiple benefits, but in this particular case we want to use it to provide context to the agent so it can generate an agents instructions file.

Open a new Copilot chat after creating the README.md file and click on a button named Create/Update agent instructions.

This will initiate an agent task that will generate an AGENTS.md file, the purpose of this file is to provide a context to the agent related to your project so that it has a better idea of what it has to do. This is the AGENTS.md file that I got. You’ll get a different one but it should be similar.

# AGENTS.md

## Project Overview
- **Purpose:** Simple Python tool for generating secure, random passwords. Designed for educational use or as a base for more advanced projects.
- **Current State:** Minimal starter code in `main.py` (prints a greeting). No password generation logic implemented yet.
- **Primary Language:** Python 3.x

## Key Files
- `main.py`: Entry point. All logic currently resides here. Intended to be expanded with password generation features.
- `README.md`: Project description, requirements, and intended usage.

## Developer Workflows
- **Run the project:**
  - Use `python main.py` to execute the script.
  - Can also run from IDE (e.g., PyCharm: green run button or Shift+F10).
- **No build or test scripts** are present. Add tests in future as needed.

## Patterns & Conventions
- Keep code simple and easy to understand—prioritize readability for educational purposes.
- Place all logic in `main.py` unless the project grows significantly.
- Use standard Python idioms; no custom frameworks or patterns are in use.
- No external dependencies required (as of now).

## Extending the Project
- Implement password generation logic in `main.py`.
- If adding features (e.g., CLI, GUI, tests), create new files/modules as needed and update this guide.
- Document any new conventions or workflows in this file for future agents.

## Integration Points
- None currently. No external APIs, services, or libraries are integrated.

## Example: Adding Password Generation
- Define a function (e.g., `generate_password(length: int) -> str`) in `main.py`.
- Use Python's `random` or `secrets` module for secure password generation.
- Print or return the generated password in the main execution block.

---

**Update this file as the project evolves to keep agent guidance current.**

As you can see, all this file is doing is to provide a brief explanation of what the project does. Create a commit with these changes including the AGENTS.md and README.md files.

Create the Django project

First create a directory called .github/prompts to place our prompts. We’ll place our prompts here because agent mode prompts can get lengthy when you need to provide a lot of context and constraints. You can get the same result by typing prompts in the chat.

Let’s test GitHub Copilot agent mode by creating a prompt instructing the agent to create the setup for this project.

Prompt

Create a file named django-setup.prompt.md inside .github/prompts with the following prompt:

# Django setup instructions
- Install django packages
- Verify installation
- Create requirements.txt file
- Create a new Django project named *PasswordGenerator*
- Create a new Django app named *generator*

After that, open a new chat in GitHub Copilot by clicking the + icon on the top right of the chat window, make sure agent mode is selected, then type and submit /django-setup

You’ll be prompted multiple times by the agent to run some commands like pip install django and django-admin startproject PasswordGenerator .
Review the commands and authorize the agent to run them if they make sense to you. At the end you should have a project structure that looks like this:

Let’s commit all the changes with the new files created, including the requirements.txt and django-setup.prompt.md files to continue with the next step.

Creating a view

Let’s create a view using agent mode to generate a random password with custom length, the only parameter that we’ll use is the length of the password.

Prompt

Create a file named create-password-view.prompt.md inside .github/prompts with the following prompt:

# Instructions

- Create a view in the generator app that generates a random password. The only argument that it takes for now is the length of the password. This should be a GET method.
- Create a complete URL setup. The URL for this view should be `/generate-password/`.
- Verify that all url files are updated to include the new URL and make sure that it works.

Run the prompt in a new chat by typing /create-password-view using agent mode and review the changes.

After running this command, the agent mode will have to add some boilerplate code to the urls.py files, but the most interesting part of it is the view that it creates. It should be similar to this:

from django.http import JsonResponse
from django.views.decorators.http import require_GET
import secrets
import string

@require_GET
def generate_password_view(request):
    try:
       length = int(request.GET.get('length', 12))
       if length < 1 or length > 128:
          return JsonResponse({'error': 'Password length must be between 1 and 128.'}, status=400)
    except (TypeError, ValueError):
       return JsonResponse({'error': 'Invalid length parameter.'}, status=400)

    alphabet = string.ascii_letters + string.digits + string.punctuation
    password = ''.join(secrets.choice(alphabet) for _ in range(length))
    return JsonResponse({'password': password})

As developers we need to always review the code that AI generates. We can see that this view receives a length parameter and generates a random password by using the secrets library. We didn’t ask the agent to implement length constraints checks or to handle exceptions, but we can leave those there as they are good to have.

The agent will sometimes take freedom to implement things you didn’t ask for. This can be useful sometimes but you always have the option to write an additional prompt requesting to remove that code or remove it yourself if you want to.

Testing the view with agent mode

When I ran this prompt something nice that I wasn’t expecting happened, the agent mode ran the project and proceeded to test the view using curl commands.

These tests were run in the console showing that the view is working properly. If your agent doesn’t run these tests you can write an additional prompt requesting to run the tests or run the server yourself and run curl "http://127.0.0.1:8000/generate-password/?length=16"

Review the changes and commit them before moving to the next step.

Creating the UI

This is a good opportunity to update the AGENTS.md file as multiple files have been modified. To do this you can open a new chat and click Update Agent Instructions.

Create a file named create-ui.prompt.md inside .github/prompts with the following prompt:

# Create UI instructions

- Create a template that displays the password generator
- The UI should have an orange faded banner that says "Password Generator"
- Add bootstrap to the project and use it to style the UI, all the elements should use bootstrap
- Below that there should be a generate password button with a numeric textbox next to it specifying the length of the password. Both of these should look pretty big.
- Add the functionality to generate a password when the button is clicked, and display the generated password below the button. Using the generate password view.
- Display the generated password in a large font below the button, make all the elements centered.

I used my own creativity and preferences to write this prompt, but you should modify it to describe how you want to stylize the UI.

Run the prompt in a new chat by typing /create-ui using agent mode and review the changes.

Error self-correction

After the agent finishes editing files it will attempt to test that the app works. If it fails it will try to self-correct. In this case the agent forgot to add the app to settings.py, but it corrected the error afterwards.

Agent mode fixing the error:

Testing the UI

At this point we have generated all the code that is needed to make the basic version of a password generator work. Let’s now open the site http://localhost:8000/ in a browser. Make sure that your project is running.

This is the result that I got, which is pretty close to what I was hoping for. You’ll get something different depending on the style that you described in the prompt.

Make sure that the password generation works when clicking the button, also check if errors like providing lengths that exceed the maximum are handled properly. Review the changes and commit them.

Congratulations, we’ve created a password generator using GitHub Copilot agent mode in just a few hours.

As you can see this UI is far from perfect, there are many improvements that can be done like making the text in the banner clearer, turn Password inside the button to lowercase or add a Length tooltip or text above the numeric textbox. That’s fine for this case as this is enough to let us see that the project works. You can improve the UI from here by writing more prompts in GitHub Copilot or by modifying the code on your own.

Next steps

This is one of the simplest ways to implement a password generator. After this version there are many improvements and changes that can be done:

• Add more options to the password generation like checkboxes to include or exclude numbers, capital letters, special characters etc
• Improve the UI
• Add a real frontend framework like React if you want to or replace Bootstrap with something like Tailwind
• Refactor and reorganize UI Javascript code
• Add unit tests
• Refactor this project to use DRF
• Try other AI models

I suggest you work on any of these tasks if you want to keep testing GitHub Copilot agent mode or develop this project further. Let me know in the comments if you’d be interested in seeing a continuation of this tutorial working on these tasks.

Final thoughts

• Using an AGENTS.md and instructions files has multiple benefits but it will be more expensive to use them in the long term, as it requires the agent to use more tokens, you should evaluate the tradeoffs of using instructions files based on the cost of tokens and how much resources you have.
• It took me around 3 hours to create this app while also writing this tutorial at the same time. You should be able to do this in less than an hour if your setup is ready.
• I was pleasantly surprised to see that the agent was capable of testing the password generator service properly using curl and seeing it self-correct.
• It was interesting to see that the agent sometimes takes the freedom to implement things you didn’t ask for. These additions were good in this case but it could be problematic in other contexts, which is why we always need to review the code.
• The project was intentionally designed to be very simple, with no databases and very little logic to give the agent a good chance of producing correct code in a short period of time. You’ll probably start noticing mistakes if you add more complex logic or more complex context to the agent.
• I personally didn’t like how the agent organized the UI code. I wish the code was cleaner and more organized, separating Javascript code. These are changes that will require more prompt iterations or manual changes. You can check the code I got in my repository if you want to.
• The results of developing this project using GPT-4.1 were pretty good. I’d like to make another article comparing different models like Claude and Gemini.
• The review process of each change produced by the agent is not trivial and can be time consuming, you should evaluate the tradeoffs of using an AI agent or building it yourself.

There’s a particular kind of quiet you only get at 22. It usually shows up around 11 PM or 7 AM (for graveyard folks like me), after the work messages stop and you’ve closed the last tab, and you find yourself sitting there with the unmoving weight of the question you can’t actually answer: am I doing this right?

In my version of that moment, the screen is usually still glowing with something about AI. A new framework. A new model release. A headline about a job category that didn’t exist five years ago and might not exist five years from now. I’m trying to learn a platform I’ll be expected to teach in two months. I’m reading about something that will probably reshape the way I do my job before I’ve finished onboarding into it. Underneath all of it sits the same low, persistent hum: everyone else seems to have a plan. I don’t have a plan. The plan doesn’t exist anymore.

We diagnose this feeling, collectively, as anxiety in your twenties. We treat the absence of certainty as a personal failure. Proof that we aren’t adapting fast enough to a world that has somehow, uniquely, fallen apart on our watch.

But the world hasn’t uniquely fallen apart. We’re just uniquely new to it.
Uncertainty isn’t new. Adulthood is.

The trick of distance
It’s easy, from the inside of your twenties, to look back ten years and see something that resembles stable ground. 2016 looks settled. 2010 looks downright pastoral. We assume the people who became adults in those years were handed a coherent script. School, job, ladder, home, retirement. We assume the ground only started moving once we stepped onto it.
This is a trick of distance.

The twentysomethings of 2016 were stepping into an adulthood being rewritten in real time by the attention economy, mass platforming, and a politics nobody had vocabulary for yet. The twentysomethings of 2009 graduated into the wreckage of a financial collapse so total it ended entire industries. The twentysomethings of the early 2000s walked into the dot com crash. The ones in the 70s walked into stagflation and the quiet death of the postwar dream. None of them experienced their decade as stable. They were guessing. They felt late. They were terrified that whatever script their parents had used was no longer running.
The ground has always been moving. The only reason it ever looked still to us is that we weren’t the ones standing on it yet. We weren’t paying rent, or holding a career together, or watching an industry mutate in real time. We weren’t responsible. It wasn’t our turn yet.
The world was never stable. We just weren’t responsible yet.
What feels unprecedented isn’t the chaos. It’s the proximity.

The alarm underneath the dread

Knowing this intellectually doesn’t actually turn the feeling off. You can read every essay about historical instability and still wake up at 2 AM convinced your industry will be unrecognizable before you’ve had time to find your footing in it. Knowing why you’re afraid doesn’t make the fear smaller. So what’s actually happening in there?

Think about what happens when you accidentally touch a boiling kettle. You don’t decide to pull your hand away. Your hand is already moving before you’ve even processed what happened. Your body doesn’t ask for your opinion. It rips you away from the thing that’s going to hurt you, and it does it in milliseconds, because the version of you that thinks first and acts second doesn’t survive a hot stove. Pain isn’t your enemy in that moment. Pain is the only reason your hand is still attached to your wrist.
Your brain runs on the same logic for almost everything it considers a threat. It wants the world to be controllable. It wants situations to have predefined conclusions. And when something refuses to behave that way, when something is uncertain by nature, like a career or an exam or an interview, your brain doesn’t say this is uncertain, sit with it. Your brain says this is a hot kettle. It floods your body with the same alarm system it would use to save your hand, and it tells you to do something. Plan. Prepare. Worry. Refresh the inbox. Rehearse the answer. Anything that resembles control.

The anxiety you feel about an unpredictable future isn’t a malfunction. It’s your body trying to protect you using the only tools it has, applied to a kind of threat those tools were never designed for.
Understanding this is the part that actually changes something. Not because the alarm gets quieter, but because you stop mistaking it for the truth. When you know your body is running a survival program written for hot kettles and approaching predators, you can start to notice the difference between I am in danger and my body thinks I am in danger. You can let the alarm go off without obeying it. You can feel the spike of dread before an interview and recognize it as the same wiring that once kept your ancestors alive, now slightly miscalibrated for a Zoom call.
And when everything starts to feel like an emergency, you can remember that when everything is an emergency, nothing is. A body in constant alarm stops being able to tell signal from noise. The cost of treating every email, every deadline, every comparison as a predator is that you lose the ability to react when something actually deserves it. Composure isn’t the absence of fear. It’s the discipline of letting your body’s alarm system run in the background while you, the part of you that can think across more than the next five minutes, decide what to do next. That is what it means to act with intention. Not to feel nothing. To feel the alarm, name it, and move anyway.

A few months ago I stood on a TEDx stage and tried to explain it. The short version is that our brains are running software written for a world that doesn’t exist anymore.

Thousands of years ago, when our ancestors felt the environment shifting around them, when the herds moved or the climate turned or the predators got closer, that feeling wasn’t called anxiety. It was called survival. It was the alarm system that pulled them out of complacency and forced them to move, adapt, migrate. Without that alarm, they died. The people whose alarms went off too loudly stayed alive long enough to pass that wiring down to us.

Now multiply that across a few hundred thousand years. The wiring never changed. What changed was the environment.

We don’t get chased by leopards anymore. We get chased by hiring cycles, performance reviews, model releases, and algorithmically curated evidence that someone our age is doing better than we are. The brain doesn’t know the difference. It reads “your industry is changing faster than you can keep up” as the exact same signal our ancestors got when the river dried up. Move. Adapt. Or you will not survive this.

The modern world has, in a sense, industrialized our survival instinct. It has taken our evolutionary dread of instability and fed it a steady diet of push notifications, layoff announcements, and comparative timelines. The alarm hasn’t gotten louder because the danger is real. It has gotten louder because the inputs are constant.

Imposter syndrome is part of that same system. When our ancestors migrated into a new valley, the unfamiliarity itself was useful information. You are not from here yet. Pay attention. Stay alive. When you walk into a new job, or a new room, or onto a stage, your brain runs the same routine. Feeling like you don’t belong yet is not a bug. It is your survival instinct correctly recognizing that you have entered new territory. It is, oddly, proof that the system is working.

The instinct is not wrong about the stakes. It is wrong about the strategy. No amount of planning beats an instinct, and no amount of planning beats a moving world.

The lone wolf trap

The natural response to all of this is to try harder. Plan harder. Optimize harder. Lock down the variables. Read every newsletter. Take every course. Build every skill. If the world is going to keep changing under your feet, you reason, then the answer must be to outrun the change. To become so prepared, so polished, so individually capable, that no amount of instability can knock you over.
I tried this. It almost broke me.

A few years before I ever stood on that TEDx stage, my father had a stroke. I was on the edge of starting college. I didn’t have language yet for what I was feeling, so I did what a lot of young men do when life suddenly stops making sense. I decided I would handle it alone. I would be the lone wolf. I would figure it out by sheer force of will, and when I had figured it out, then I would let people back in.
I shut the world out for about three months.

The lone wolf strategy is seductive because it sounds like maturity. It sounds like ownership. It sounds like the kind of thing successful people on the internet recommend doing. But biologically, it is the exact opposite of what our species was designed for. Our ancestors did not survive predators by going off alone. They survived by taking turns sleeping so somebody was always watching for danger. The lone wolves in our evolutionary history did not pass their genes down to us. They got eaten.

Three months of being alone with my own alarm system did not make the alarm quieter. It made it louder. Because the thing the alarm was actually asking for, the thing it had been asking for since the savanna, was not a better plan. It was other people.

The free food event

I broke the lone wolf streak almost by accident. The first thing I did was join something called the Jollibree Project (https://www.facebook.com/profile.php?id=100094425204258), feeding street children. I told myself I was doing it to be useful. I think I was actually doing it because I needed to be around people again and didn’t know how to ask. What I learned, with some embarrassment, was that you do not need to have your own life fully figured out before you start showing up for other people. The two things happen in parallel. Sometimes the second is how you survive long enough to do the first.

Later, I went to a tech event for the free food.

The story I usually tell when I’m telling it well is that I was 20 and broke, and I went because dinner was included. What I found at the event wasn’t the food. It was the conversations. People talking about cloud platforms and certifications and architectures in a way that nobody at my university was. I went home that night thinking less about what I’d eaten and more about what was missing back where I came from.

As my mentor told me: “We go for the swags and food, we stayed for the community”

And I told to anyone who wants to join to any communities: You don’t attend to contribute, you attend to belong.

What I ended up building out of that gap became, eventually, a national tech community of almost 10,000 members across dozens of chapters. None of that was planned. It came from noticing something missing and walking into it. From mentors like Raphael Jambalos, Raphael Quisumbing, Joshua Arvin Lat, and Jon Bonso who reminded me, repeatedly, that nobody scales anything alone. From the slow, accumulating realization that everything I was most proud of in my twenties had been built with other people, not in spite of them.

Our ancestors didn’t cross continents because they had a map. They moved because the environment moved first, and they were responsive to it. They didn’t solve uncertainty. They survived it together. That is not a metaphor. That is the literal mechanism by which our species made it this far. Connection wasn’t an emotional luxury. It was, and still is, a survival technology.

The two things at once

So there are actually two things to hold here, not one.
The first is that the world was never stable. Every generation before us walked into a version of this same room. They felt late. They felt unequipped. They felt the ground move under them. They were not given a plan, and they did not figure life out. They navigated it. The reason it feels unprecedented to us is not that the chaos is unique. It is that the responsibility is.

The second is that we were never supposed to navigate it alone. The same biology that makes uncertainty feel like a predator also gave us the only real defense against it, which is each other. The brain that screams at you to control the uncontrollable is the same brain that, if you let it, will calm down the moment it realizes it is not the only one keeping watch.

You are not failing because you don’t have a clear plan for a world that’s mutating in real time. You can’t solve an ongoing mutation. You can only stay close to it. Keep learning. Keep adapting. Keep building the small handful of relationships that will let you read the terrain you can’t see yet. That is what your twenties are actually for. Not figuring it out. Learning, slowly, that figuring it out was never the assignment.
The world was never stable. We just weren’t responsible yet.
And we were never meant to face it alone.

That is not the bad news. That is the part that makes it survivable!

Find your people. Keep watching for each other. The rest is just the work!

(https://builder.aws.com/content/2sKOfQ0ky8310fifis1TtWULjhw/awsug-leadership-summit-philippines-2025-we-built-this-for-them-what-happens-next-is-theirs-to-build)

A version of these ideas also became the foundation of a recent TEDx talk I gave on uncertainty, migration, and why humans were never meant to survive alone.

You can Watch my TedX talk that complements this blog: https://www.youtube.com/watch?v=cAlC4lVCsNw