Using Math.random() to generate an API key or secret is a real, common mistake, since it’s not designed to be unpredictable in a security sense, only in a statistical one. It’s fine for shuffling an array. It’s not fine for anything a determined attacker might try to guess or reproduce. This generator uses the browser’s crypto.getRandomValues() instead, the same cryptographically secure source used for real security-sensitive randomness.
Why Math.random() Isn’t Safe for This
Math.random() is generated by a fast, predictable algorithm not designed to resist an attacker who’s seen enough of its output to potentially predict future values. crypto.getRandomValues() pulls from the operating system’s cryptographically secure random number generator, the same source used for generating actual encryption keys, and it’s the correct choice any time randomness has real security consequences.
FAQ
Is this safe to use for a real production secret?
The randomness itself is cryptographically sound, generated entirely in your browser and never transmitted anywhere. Treat the generated value the same as any other secret once you copy it: store it securely and don’t share it.
How long should an API key or secret be?
32 characters from a reasonably sized character set is a common, safe default for most application secrets. Longer is safer but rarely necessary beyond that for typical use cases.
