Math.random() or random for tokens, passwords and session ids

Shortcuts that trade away safety: one of the ways AI coding agents bloat software, from lessloc's pattern catalog. lessloc catches it as unsafe: crypto.randomUUID(), getRandomValues() or the secrets module.

What makes Math.random() or random for tokens and passwords a bad practice?

The standard that calls it a bad practice: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator.

What does lessloc do about Math.random() or random for tokens and passwords?

lessloc catches it as unsafe: crypto.randomUUID(), getRandomValues() or the secrets module.

• unsafe (tier 1): A shortcut that trades away safety: SQL built from values, HTML built or escaped by hand, Math.random() for secrets, a fast hash for passwords, certificate checks turned off, text run as code.

Examples

Caught as unsafe:

export const token = () => Math.random().toString(36).slice(2);

Written well:

export const token = () => crypto.randomUUID();

Related patterns

Hand-written versions of what the platform does safely. They are short, which is why agents reach for them. The other patterns in Shortcuts that trade away safety:

• SQL built from values instead of query parameters: lessloc catches it as unsafe: pass values as query parameters.
• HTML built or escaped by hand: lessloc catches it as unsafe: use textContent or the framework's rendering.
• Fast hashes (MD5, SHA-1, SHA-256) for passwords: lessloc catches it as unsafe: bcrypt, scrypt or argon2.
• Certificate checks turned off: lessloc catches it as unsafe.
• Running text as code: eval, exec, new Function: lessloc catches it as unsafe: parse the input instead.