Home / Knowledge hub / CSPRNG
Knowledge hub
CSPRNG
A random number generator safe to use for secrets, tokens and keys.
What it means
A CSPRNG is a cryptographically secure pseudorandom number generator. It is the one kind of random source you are meant to use for anything that an attacker must not be able to guess: session tokens, password reset links, API keys and encryption keys.
The difference from an ordinary random function is not how random the output looks. It is that someone who sees a long run of outputs still cannot work out the next one, or the earlier ones. Everyday generators built for games, shuffling and simulations make no such promise at all.
Why it matters
Security tokens are only as strong as the generator behind them. If a reset link comes from a weak source, an outsider can request a few, spot the pattern and predict the one sent to someone else. No password was cracked and no server was breached; the link was simply worked out.
This is a quiet failure. The tokens look random, tests pass, and a reviewer sees a function returning a long string. The weakness only shows when someone studies the output. The result can be account takeover or forged session tokens, which are costly to explain to customers.
How it shows up
Every mainstream platform ships one: crypto.randomBytes or crypto.getRandomValues in JavaScript, the secrets module in Python, SecureRandom in Java, and the operating system source such as /dev/urandom. Use these directly, or through a well-known library, for every value that grants access.
The mistakes repeat. Math.random() used for tokens. A generator seeded with the current time. A token built from a user id plus a timestamp. A good value shortened to make it tidy. Search the code for every place a secret is made and check that each one names a secure source. See also predictable randomness.
Questions people ask
CSPRNG, answered
Is Math.random() a CSPRNG?
No. In JavaScript it is meant for ordinary tasks such as shuffling or animation, and the language specification does not require it to be unpredictable. Never use it for a token, a code or a key.
Use crypto.getRandomValues in the browser or crypto.randomBytes in Node instead.
What is the difference between random and pseudorandom?
Computers produce pseudorandom values: output from an algorithm that starts from a seed. That is fine for security, provided the seed is unpredictable and the algorithm is designed to resist prediction.
A CSPRNG meets both conditions. A plain pseudorandom generator may not, which is why its output can sometimes be reconstructed.
Are UUIDs safe to use as secret tokens?
It depends on the version and the library. A version 4 UUID is random, but only as good as the generator that filled it. Older versions are built from a timestamp and a machine identifier, which can be guessed.
If a value must stay secret, generate it directly from a CSPRNG and do not rely on the UUID format.
How long should a random token be?
Long enough that guessing is not realistic. OWASP asks for at least 64 bits of entropy in a session identifier, and many teams use 128 bits or more, which is 16 bytes from the generator.
Length only helps if the bytes come from a secure source. A long value from a weak generator is still weak.
How do we test whether our tokens are predictable?
Collect a large batch of tokens and look for patterns: shared prefixes, counters, timestamps, or values that correlate with user ids. Then compare how they are generated in the code.
A tester who can predict one token from others has found a vulnerability, which is how it should be reported.
Related
Terms that sit next to this one
Entropy
How unpredictable a value is, which decides how hard it is to guess.
Predictable randomness
Tokens or codes made from a generator an attacker can work out or guess.
Session token
A random value the browser sends to show it belongs to a signed-in visit.
Password reset flaw
A weak reset link or code that lets someone else take over the account.
Token
A string that stands in for an identity or a permission.
Can a token be guessed?
We check whether the reset links, session values and keys your app issues can be predicted, and every finding arrives with the request and response that proved it. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.