random and secrets — Choosing the Right Random Numbers

This article covers the two random-number modules in the standard library. random provides pseudorandom values for tests, games, and simulations (reproducible with seed), and secrets provides unpredictable values for passwords, reset tokens, and API keys (drawn from the OS's cryptographic random source). Picking the right one for the job is what the rest of the article is about.

How random and secrets Differ

Both modules return random numbers, but the mechanism and the use cases are completely different. random is built on the Mersenne Twister (a widely used pseudorandom-number generator), and calling random.seed(value) lets you reproduce the same sequence. secrets, on the other hand, draws from the OS's cryptographic random source (such as /dev/urandom), so there's no `seed` concept and the values are unpredictable every time.

For cases like tests or games — "it's fine if the result leaks" — reach for random. For passwords, tokens, and session IDs — "someone predicting the value would be a security incident" — reach for secrets.

random — The Basics (randint / uniform / choice)

The basics of random are three things: a random integer / a random float / picking one element from a list. random.randint(low, high) returns an integer including both ends, random.uniform(low, high) returns a float in the given range, and random.choice(list) returns one element from the list.

Let's start without seed and see how these basic functions behave.

Try the three basic random functions. The values are different every run, so we'll verify them by range and membership checks instead of exact comparison.

① Import random.

② Generate an integer in 1〜100 with random.randint and store it as n; generate a float in 0〜1 with random.uniform and store it as f; pick one element from ["Apple", "Banana", "Cherry"] with random.choice and store it as picked.

③ Print whether n is in 1〜100, whether f is in 0〜1, and whether picked is a member of the original list, formatted as int range: True / False, float range: True / False, in list: True / False.

(If your code runs correctly, the explanation will appear.)

random — Seeded Reproducibility and Collection Operations

Now let's look at test reproducibility with `random.seed` and collection-operation functions (shuffle / sample). After calling random.seed(N), the same seed always produces the same sequence. random.shuffle(list) shuffles the list's elements in place, and random.sample(list, k) returns a new list of k unique elements drawn from it.

Confirm that a value generated with seed 42 matches a value generated again after re-seeding to 42.

① Import random.

② Set the seed to 42, then call random.randint(1, 100) once and store it as n1.

③ Set the seed back to 42, then call random.randint(1, 100) again and store it as n2.

④ Print n1 == n2 as reproducible: True.

See the difference between shuffle (rearranges the list itself) and sample (returns a new list).

① Set the seed to 7 and prepare cards = [1, 2, 3, 4, 5].

② Call random.shuffle(cards) to rearrange the contents of cards in place. Print the rearranged cards as after shuffle: ◯◯.

③ Re-seed to 7, then call random.sample([1, 2, 3, 4, 5], 3) to pick 3 unique elements, and print the result as picked 3: ◯◯.

secrets — Strong Random for Security

The random module from the previous sections is a pseudorandom generator for tests — if its internal state leaks, the next values can be predicted. For things like password reset tokens, API keys, and session IDs — "if an attacker can predict the value, you have a vulnerability" — pick the `secrets` module, which uses the OS's cryptographic random source.

secrets has a much smaller API than random — it's mostly helpers that turn random bytes into hex strings or URL-safe strings.

Generate security tokens with secrets and check their length and character set. The actual values change every run, so we verify properties like length.

① Import secrets.

② Generate a 16-byte hex token, print its length as hex length: ◯, and then check it contains only characters in 0-9 and a-f with hex is hex only: True / False.

③ Generate a 16-byte URL-safe token and print its length as urlsafe length: ◯.