Home / Knowledge hub / Predictable randomness
Knowledge hub
Predictable randomness
Tokens or codes made from a generator an attacker can work out or guess.
What it means
Predictable randomness is when a value that is meant to be random can in fact be worked out. The cause is a weak generator, a poor seed, or a token built from things an attacker can see, such as a timestamp. MITRE tracks this under CWE-330, use of insufficiently random values.
The token still looks random. It might be 32 characters of hex, and it might pass every quick check a developer applies. The weakness is invisible to anyone who does not study how it was produced, which is why it passes casual review so often.
Why it matters
The consequence is that secrets stop being secret. A password reset link that can be predicted lets someone take over another account after requesting a few of their own. A predictable invite code, coupon or download link exposes records to anyone who can count.
It sits behind well-known account takeover stories, and it is expensive to fix after the fact because every value already issued must be treated as exposed. Customers and auditors will ask how many were affected, and the honest answer is "all of them".
How it shows up
Typical causes: Math.random() or a language default generator used for security, a generator seeded with the time in seconds, a token made from a user id plus a timestamp, or a counter encoded to look opaque. Some generators can be rebuilt from enough outputs; knowing the algorithm and a stretch of output is sufficient.
Look at reset links, email verification, invitations, API keys, file names, session tokens and one-time codes. Request several in a row and compare. If two values share a prefix, rise together or relate to the time of request, they are not random. The fix is a CSPRNG on every one.
Questions people ask
Predictable randomness, answered
How can someone predict a random number?
If the generator is a simple algorithm and the attacker sees enough outputs, they can sometimes calculate its internal state and every value that follows. Or the seed is a time they can narrow down.
Secure generators are designed so neither is possible.
Is a UUID a safe token?
Not always. A random version 4 UUID is only as good as the generator behind it, and older versions use timestamps and machine identifiers. If a value grants access, take it straight from a secure generator.
Do not rely on the format to supply the security.
What gets attacked first when randomness is weak?
Password reset links and session identifiers, because they lead directly to an account. Invitation links, coupons, order numbers and file download paths are next.
Anywhere a secret value is the only thing standing between a stranger and a record.
Does hashing a predictable value make it safe?
No. Hashing a counter or a timestamp gives something that looks random but still takes only a few guesses to reproduce. An attacker simply hashes the likely inputs and compares.
The input has to be unpredictable, not just the output.
How do we test for it?
Generate a batch of tokens in quick succession and look for structure, then compare against the time and the account involved. Review the code for generator calls on security paths.
A tester who predicts the next value has a finding with proof.
Related
Terms that sit next to this one
CSPRNG
A random number generator safe to use for secrets, tokens and keys.
Entropy
How unpredictable a value is, which decides how hard it is to guess.
Password reset flaw
A weak reset link or code that lets someone else take over the account.
Session token
A random value the browser sends to show it belongs to a signed-in visit.
Enumeration
Working out what exists by asking repeatedly and watching the answers.
Could someone guess your next token?
We request batches of tokens, links and codes from your running app and check whether the next one can be worked out, with the code that makes them where we can read it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.