Do not use a pseudo-random number to generate a secret

Docs > Code Analysis > Static Analysis Rules > Do not use a pseudo-random number to generate a secret

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: java-security/no-pseudo-random-secret

Language: Java

Severity: Warning

Category: Security

CWE: 338

Description

Never use the Random class to generate secrets. Instead, use the SecureRandom class.

Learn More

Non-Compliant Code Examples

class MyClass{
    public String generateSecretToken() {
        Random r = new Random();
        return Long.toHexString(r.nextLong());
    }
}

Compliant Code Examples

import org.apache.commons.codec.binary.Hex;

class Class {
    String generateSecretToken() {
        SecureRandom secRandom = new SecureRandom();

        byte[] result = new byte[32];
        secRandom.nextBytes(result);
        return Hex.encodeHexString(result);
    }
}