“Random” vs. Truly Random
Not all randomness is equal. JavaScript's Math.random() uses a deterministic algorithm — given the same seed, it produces the same sequence every time. An attacker who knows the algorithm and seed can predict every “random” value it produces.
crypto.getRandomValues() is fundamentally different. It draws from your operating system's entropy pool — a mix of hardware events like mouse movements, keyboard timing, disk I/O, and thermal noise. The result is cryptographically unpredictable, even to an attacker with full knowledge of the algorithm.
Best Practices for Random Passwords
✓Use 16+ characters — every additional character makes cracking exponentially harder
✓Include all character types (uppercase, lowercase, numbers, symbols) for maximum entropy per character
✓Generate a unique password for every account — never reuse passwords across services
✓Store passwords in a manager (Bitwarden, 1Password, KeePass) — don't try to memorize random strings
✓Enable 2FA wherever possible — even the strongest password can be phished