Python random vs secrets: Security Differences

Choose the correct source of random values for simulations or security.

What It Does and Why It Matters

The random module produces deterministic pseudorandom sequences and supports repeatable tests. The secrets module uses a system-provided source suitable for tokens and one-time codes. A secure token should have adequate entropy and must not be seeded with a fixed value.

Only use the deterministic generator where reproducibility is intended.

Pseudorandom examples are suitable for simulation and tests. Use secrets instead for tokens, passwords and authentication.

Step-by-Step Example

Start with the complete example below. Read the inputs and predict what the final print statement will show before you run it.

import random
import secrets
simulation_generator = random.Random(17)
print(1 <= simulation_generator.randint(1, 6) <= 6)
secure_token = secrets.token_urlsafe(16)
print(isinstance(secure_token, str))
print(len(secure_token) > 16)

How the Code Works

The imports make these standard-library tools available: random, secrets.
The name simulation_generator receives the value of random.Random(17). Changing this input lets you explore a different case.
The print calls display the results. Compare these results with the method’s documented return type and the input used.

Expected output:

True
True
True

Each displayed line comes from the corresponding calculation or check. The output helps verify the return values before you adapt the example to your own input.

Second Example: Compare Two Cases

Use a different input or a related operation to observe an important difference. The two examples help separate the general rule from one particular result.

import random
rng=random.Random(7)
print([rng.randint(1,6) for _ in range(4)])

Expected output:

[3, 2, 4, 6]

Where You Would Use This

Use the technique when it makes a real task easier to understand or safer to maintain. Check input and output behavior with small tests before combining it with larger application code.

Practice Exercise

Build a reusable token generator using secrets.token_urlsafe() rather than random.

Before running your edited example, write down the result you expect. Then test at least one valid boundary or deliberately invalid value, using appropriate exception handling where necessary.

Reference: official Python documentation for the complete API contract and version notes.

Common Beginner Mistakes

Using random.choice(), randbytes(), or a seeded generator to create password-reset or API tokens.
Overlooking the documented condition: a secure token should have adequate entropy and must not be seeded with a fixed value.

Key Takeaways

Choose the correct source of random values for simulations or security.
The random module produces deterministic pseudorandom sequences and supports repeatable tests.
Build a reusable token generator using secrets.token_urlsafe() rather than random.
Pseudorandom examples are suitable for simulation and tests. Use secrets instead for tokens, passwords and authentication.