Python Why random Is Not Suitable for Passwords

Understand why a predictable random-number generator must never create passwords or tokens.

What It Does and Why It Matters

The random module uses a deterministic pseudorandom generator. Once its internal state is known, later values can become predictable; a public seed is particularly easy to reproduce. Security-sensitive applications need an operating-system-backed source such as secrets. Neither a long password nor a fixed seed compensates for a predictable generator.

The secrets token varies on every execution. Do not display real authentication tokens in logs or documentation.

Pseudorandom examples are suitable for simulation and tests. Use secrets instead for tokens, passwords and authentication.

Step-by-Step Example

Start with the complete example below. Read the inputs and predict what the final print statement will show before you run it.

import random
import secrets

first = random.Random(27)
second = random.Random(27)
print(first.randint(1000, 9999) == second.randint(1000, 9999))
secure_token = secrets.token_urlsafe(16)
print(len(secure_token) >= 16)

How the Code Works

The imports make these standard-library tools available: random, secrets.
The name first receives the value of random.Random(27). Changing this input lets you explore a different case.
The print calls display the results. Compare these results with the method’s documented return type and the input used.

Expected output:

True
True

Each displayed line comes from the corresponding calculation or check. The output helps verify the return values before you adapt the example to your own input.

What to Notice

Pay attention to the accepted input types, the returned value and the boundary behavior. Predict what changes if you replace the example input with an empty, zero, negative or missing value, where that value is meaningful for this operation.

If the task uses a library function, inspect its documented exceptions and return type before reusing it inside a larger function.

Where You Would Use This

Use the technique when it makes a real task easier to understand or safer to maintain. Check input and output behavior with small tests before combining it with larger application code.

Practice Exercise

Create a six-digit demonstration code with random and a separate real secret with secrets; identify which is safe for authentication.

Before running your edited example, write down the result you expect. Then test at least one valid boundary or deliberately invalid value, using appropriate exception handling where necessary.

Reference: official Python documentation for the complete API contract and version notes.

Common Beginner Mistakes

Using random.choice() or a seeded Random instance for password reset links or session IDs.
Checking only the easiest input and missing a relevant error or boundary case.

Key Takeaways

Understand why a predictable random-number generator must never create passwords or tokens.
The random module uses a deterministic pseudorandom generator.
Create a six-digit demonstration code with random and a separate real secret with secrets; identify which is safe for authentication.
Pseudorandom examples are suitable for simulation and tests. Use secrets instead for tokens, passwords and authentication.