Why Math.random() Passwords Are Crackable and What Developers Should Use Instead

A developer describes how a password reset flow built on Math.random() was broken by a penetration tester, who reconstructed the generator's internal state from two consecutive outputs. The article explains that V8's xorshift128+ is a deterministic pseudorandom generator, not a secure one, so its outputs can be predicted. It recommends drawing randomness from the operating system's cryptographically secure source instead, such as Python's secrets module and Node's crypto.randomInt(). Sample code in both languages demonstrates generating 16-character passwords with roughly 95 bits of entropy. The author also notes that for quick one-off credentials, reputable online generators are a practical alternative to writing code.