randombytes

randombytes is a minimal shim that exposes a single function for generating cryptographically secure random bytes, working identically whether the code runs in Node.js or in a browser. On Node it forwards directly to the built-in crypto.randomBytes; in the browser it falls back to the Web Crypto API’s crypto.getRandomValues (or the legacy msCrypto prefix), automatically chunking requests larger than the 65,536-byte limit that browsers impose on a single call.

Originally split out of the browserify ecosystem so that bundlers could polyfill Node’s crypto module for browser targets, it has become one of the most widely depended-upon low-level primitives in the npm ecosystem — a building block that other cryptography and utility packages rely on rather than reimplementing random-byte generation themselves.

What You Get

• Isomorphic API: the same randomBytes(size, [callback]) signature works in Node and in browser builds
• Automatic chunking around the browser’s 65,536-byte getRandomValues limit
• Synchronous and callback-based async usage from the same function
• Zero runtime dependencies beyond the host platform’s crypto implementation

Common Use Cases

• Generating unique tokens, IDs, or session identifiers by encoding the returned bytes as hex/base64
• Sourcing entropy for cryptographic keys and initialization vectors in browser-bundled crypto libraries
• Polyfilling Node’s crypto module so bundlers like browserify/webpack can run unmodified Node code client-side
• Generating fixed-length salts or padding without pulling in a heavier crypto dependency

Under The Hood

Architecture randombytes has essentially no internal architecture beyond a deliberate dual-entry-point split: index.js is a one-line re-export of Node’s built-in crypto.randomBytes, while browser.js is a self-contained implementation gated by package.json’s browser field, which bundlers like browserify and webpack use to swap in the browser-safe version at build time instead of the Node version. There is no shared module, no dependency injection, and no internal data flow to trace — each entry point independently satisfies the same (size, callback) => Buffer contract, so changing the core abstraction would require touching exactly two isolated files with no risk of hidden coupling elsewhere.

Tech Stack The package has zero runtime dependencies — index.js calls straight into Node’s native crypto module, and browser.js calls the Web Crypto API (crypto.getRandomValues, with an msCrypto fallback for legacy Internet Explorer) with no polyfill library in between. Its devDependencies (a linter for style enforcement, a lightweight test runner and reporter, and a browser test runner that exercises the suite against real browsers/PhantomJS via a CI service) exist purely to validate the two implementations, not to power them. Distribution relies on npm’s package.json browser field convention, which is what lets it slot into browserify/webpack builds as crypto’s random-byte primitive without any explicit configuration from consumers.

Code Quality The test suite covers both the synchronous and callback-based async code paths, asserting correct output length across a range of sizes including right at and past the browser chunking boundary, plus explicit error-path assertions for oversized, negative, and non-numeric input. There is no TypeScript or type annotations anywhere in the codebase — it’s plain, unannotated JavaScript relying on a style linter rather than a type system for consistency. The configured CI service (Travis CI) is a legacy, largely defunct offering at this point, so despite tests existing and passing locally, there’s limited confidence any CI is actually still validating changes on this repo.

What Makes It Unique There’s nothing technically novel here — the browser-side chunking workaround is a well-known, necessary accommodation for a documented browser API limit, not an original technique. Its significance is entirely as foundational, widely-adopted infrastructure: an extremely small, dependency-free primitive that a large share of the npm ecosystem’s higher-level crypto and utility packages build on top of rather than reimplement.