← Sunday, October 11, 2026SecurityDeep dive

Python's random and secrets modules serve different security needs

lwn.net by jake Editor score 7/10

Python's random module is not suitable for passwords or tokens, while secrets is intended for those uses; the two have sometimes been confused despite the documentation. Engineers handling credentials should know which API provides the right security properties.

What

Python’s random and secrets modules both generate random values, but only secrets is suitable for passwords and security tokens.

How

Despite documentation warning that random was unsuitable for cryptography, developers used it for passwords and tokens; Python 3.6 added secrets in 2016.

Why it matters

Engineers should use secrets for credentials and tokens rather than relying on random for cryptographic security.

Read on lwn.net →

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.