How to Generate Cryptographically Secure UUIDs and Passwords in Browser
“Why `Math.random()` should never be used for security-sensitive tokens, how the Web Crypto API delivers true entropy, and how to create uncrackable credentials on your own machine.”
1. Why Math.random() Is Not Secure
Standard pseudo-random number generators (PRNGs) like JavaScript's `Math.random()` are deterministic. Given an initial internal seed state, an attacker can predict future values.
For secure identifiers and login credentials, applications must use a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) such as `window.crypto.getRandomValues()`. Our Password Generator and UUID Generator rely entirely on native browser hardware entropy, ensuring tokens are mathematically unpredictable.
2. The Architecture of UUID v4
A Version 4 UUID contains 128 bits of data, with 122 bits of pure entropy and 6 bits reserved for version and variant metadata. With approximately $3.4 \times 10^{38}$ possible combinations, the chance of generating two identical UUIDs across global databases is virtually zero.
Frequently Asked Questions
Related Guides & Articles
View all guidesYour Free Online Toolbox
192 free tools, no sign-up required, 100% private in-browser processing. Merge PDFs, resize images, format code, and automate daily tasks in seconds.