Articles
The reasoning behind how these generators are built, written to be accurate enough that a senior engineer would not wince.
Why Math.random() is not secure The specification, the engine internals, and the five audited sites that still ship it CSPRNG vs PRNG Next-bit unpredictability, state compromise resistance, and the chain down to the kernel Modulo bias, explained The 256 mod 62 worked example, rejection sampling, and why Shannon and min-entropy disagree Password entropy and crack time The exact formula, where it stops holding, and why the hash dominates the answer UUID v4 vs v7 Both layouts from RFC 9562, the B-tree argument, and the timestamp leak Choosing an identifier format Seven formats against three jobs, with the numbers and the honest caveats Common mistakes in token generation Eight real failures in shipped token code, quoted and quantified How to generate secure tokens The correct API per language, plus length, storage and comparison Base64 vs base64url Two alphabets, two characters apart, and where that matters What NIST SP 800-63B-4 actually requires The real requirements, quoted, plus the PCI DSS conflict Ambiguous characters, and what excluding them costs The confusable sets, when to drop them, and the 5.70 percent bill How to test a random generator Four tests, our results, and the control that proves they work