Use secrets, not random, and remember the shuffle

Sun, 24 Aug 2025 00:00:00 +0000

Python gives you two ways to pick something at random, and only one of them belongs anywhere near a password.

random is a Mersenne Twister. It is fast, it is reproducible, and that second property is exactly the problem: it is a deterministic algorithm driven by internal state. Observe enough of its output and you can recover that state and predict everything it will produce next. For a dice roll or a shuffled playlist, wonderful. For anything that guards access, disqualifying.

Cryptography on Wilhelm Maritz

Use secrets, not random, and remember the shuffle