Question 1

Is Math.random() suitable for security tokens?

Accepted Answer

No. Math.random() uses a pseudo-random generator seeded from the page start. Output is predictable enough that someone watching a few values can guess the next one. For anything security-adjacent (session IDs, password resets, CSRF tokens, encryption keys), use Generate Random Bytes, which calls crypto.getRandomValues() and uses the OS cryptographic random source.

Question 2

How random is the output actually?

Accepted Answer

Generate Random Bytes uses the Web Crypto API, which most browsers back with the OS CSPRNG (/dev/urandom on Linux, CryptGenRandom on Windows, SecRandomCopyBytes on macOS). For scientific work needing audited randomness, use a dedicated library or hardware source. For every practical web-dev use case, these are indistinguishable from true random.

Question 3

Can I generate thousands of values at once?

Accepted Answer

Yes. Each generator accepts a count parameter with no hard cap from the tool itself. The only limit is browser memory. A million 32-bit random binary strings finishes in a second or two on a modern laptop.

Question 4

Why are results different every time?

Accepted Answer

That is the point. Each run reseeds (for cryptographically secure bytes) or pulls fresh pseudo-random state (for letters and binary). If you need reproducible random output for tests, seed your own generator in code. These tools are for fresh randomness on demand.

Question 5

Are the generated values sent to a server?

Accepted Answer

No. All four generators run entirely in the browser. Bytes, letters, binary, and bitmap pixels never leave the page. The browser network tab confirms no requests are issued during generation.