Security Tokens

Generate Security Tokens with Cryptographic Randomness

Many security features depend on a value that an attacker must not be able to guess. Password-reset links, email-verification links, invitation codes, session identifiers, and one-time capability URLs are common examples. If such a token is predictable, an attacker may not need to steal it. They may be able to guess a valid value instead. The defensive requirement is therefore stronger than “make the token look random.” A security token needs enough entropy, meaning uncertainty from the attacker’s point of view, and it needs to come from a generator designed for security-sensitive randomness.