Random alphanumeric (base-62) strings in Node.js, cryptographically strong

randomStr.js

var bases = require('bases');
var crypto = require('crypto');

// Returns a base-62 (alphanumeric only) string of the given length:
function randomStr(length) {
    // We generate a random number in a space at least as big as 62^length,
    // and if it's too big, we just retry. This is still statistically O(1)
    // since repeated probabilities less than one converge to zero. Hat-tip to
    // a Google interview for teaching me this technique! ;)

    // The native randomBytes() returns an array of bytes, each of which is
    // effectively a base-256 integer. We derive the number of bytes to
    // generate based on that, but note that it can overflow after ~150:
    var maxNum = Math.pow(62, length);
    var numBytes = Math.ceil(Math.log(maxNum) / Math.log(256));
    if (numBytes === Infinity) {
        throw new Error('Length too large; caused overflow: ' + length);
    }

    do {
        var bytes = crypto.randomBytes(numBytes);
        var num = 0
        for (var i = 0; i < bytes.length; i++) {
            num += Math.pow(256, i) * bytes[i];
        }
    } while (num >= maxNum);

    return bases.toBase62(num);
}

for (var i = 1; i < 80; i++) {
    console.log(randomStr(i));
}

randomStr.txt

n
Fj
Zuf
Qewt
YzKp2
ARo7Ym
629xow7
vPdGF8Vx
MQlxlgsOU
EhIuYD3r32
ro0nwTnz44w
gHjfLjflzqgY
tTyr1fy62GKYy
BBUuD9KhkyICOA
A36xHiZIqG0ksKS
X9DdiWElSUQEMEyG
sskrmb6LWS4Smsimg
Aw49rNTFN6IC6Qy0uY
AyXDmmjcqWWmmY8uuKM
TiK0Ps8ra82igYmaYsmM
EwKuPgb8U8mOAS22YYiw0
xihPfDRhiSsgGgUAikoCOC
uB2uAuJFBIMYYY8S6sSG6kE
mW4DzyWnOokEoYSUgCiiCas2
XnxSqxTHmCIAsigWusOk6YCyA
lodRWjHBGC0cY2MCqKoIQqAWua
8EZttmGxXigkmsAS0aUSwMsWkUm
L16lxbE8kSoO6WacQiMsUCQcC6ao
KQgZMStN28M8OUw6EwYUQYaOcoUQq
IEzAddFN2m6owmQSKOYQCo0i0ySSeW
ZMFFfJBLIkIckkqyg4kMYKggiSMQko
a4ZLM7nQ0EKISKOEmiYwK6SCe20AA8gs
xhGo4aDv1uqMIMIqewEI4oMOqCMw0WKg8
RZcQGuJDc28Ei4yEUe8AUWKUGIcMk2ogoe
fHpcWD5LgsOQAMgcMsYkiwk2kKEYSakGo2M
fufHNCLhcImqiOcMKGsssUaGe6GWw4gyaqUi
MfPBmiig4UYKyogseMCmyi6s26yMwMkmq4qcI
6IvtXxRuRGOkSwgW8Iq0C4cWKcICo2iaisUAIa
aovEVfJdZYY0gEY4K8C0eYgsaeKEgY4wQKwEkse
RTfRASTeCI8qCSGeQk0su6qM6wyW6446O6q6SK8q
LYUa50jMUCCiUsckCSW0ayKSYeuScweAIwSWGEkQS
4mxzCYXHYcaOCwo0ySGy64G4QsqQoYiWoyaKKukImA
qCmIiARn4ks8OmEEMSqEeG2EAauoaUMko8SW86YSoWm
glOL2pZQ1aOIMQakGwcEEcSqAWIqS0IuAyOC2Kwy84ws
pdLVnjjUPesEYi6MsKUCSccQK0qeuYESGIOumY8E8AM6K
OTAv8bD8YwI0OuUaGayOk6SAMMOYmi28OysM82SCs4qiam
TVTQbMYf6gKsKSeyQWMmSqOwmEc6UekMECuWCoSQO6OE0MO
9melnBOB5SMcQ48WWGyEuOsIWqycUsYe02U4Kueoo0yAqcaI
envG6K0miIKuoGagGCueKewqeWW8qs444wIcC4geoIEum2mCE
cM8mwmznBCkUgQUammsqc0sGQaEyGyyckocS0m4Q4Se4Mcu2iA
6EOpKpjYrYKQyE0MCWkQqoMMGsCwKA6mSCSQCai82cMCcywCI2o
z9VqUc69FusyIS2WQ0cmWe2MsYigqCo8eoGYwogiAUsIiM6Q82yK
mZ23DeHSVMggow8eeYKWuGgOaCgOUgS0eIkSGimYEEAig2Y0oEc0O
rRhrS5QeqcssgoEgcwAQE8aIo8mECuaUwEmGYIGK0yk0sWSoAiyq0q
W6CAOk5wK4qGyYsKEOSiw0mwk8SuWcCQggK60G2A8aqs6MCUceAyiCC
uAfTmqQL16oYwSyE2iM60o6eqeCGOCAAuK444Mqwe8EmQIumkYI4UKca
iTGaVUWHvyAwwIK8CQKaksm88GMw84GqKkGOMkyAoSqAAKA40UeaqoYQs
oo4Rs3nr7EQmgWsakeSqGAqq8MugceKwoCEG2ScG2Kq2i0Uy2WIqkGI2yK
gq0bCSPO2kwES8ko4ge2ckEqgQy8uwCEkKWUAC2S4GmomO2acuG0C48ya6S
CaC8IjFUzYYOKWSWoYUAUUYuiYYK2qWUIUQM6KMo8ky8ICQEQ48ck2Cu2amI
HwJp3C1rgW2YoUcCuG8sCMw88ymwGwKcmQw0g84IuUS2SOeYcIWuqCo4skq2y
miVqAVrpEO4K8G0EweMsUyGWOEgcWaKyQWuUOKmuKEm8k48qAcuq2OuqimAms4
xcIm06LTrMqsOsYuIaaKKm0aiUMs08isOmGwM0iA08s220AAIUuguGEyoeiWaM6
RU1l7PlUA0cyIuIIc6GsuImCSkUY0AMkeGgW4e8ges00cWky04umkiI4YaOuCO86
Psta9FI86qUmQ2yy86UiUEciQQgYKSk8QCcQG4sS6Ysm4YYGcmYmkyqQys0Uo8Y28
W6dd8uVrIkcEuYmMcqC8wKee4CMwamWsaGAmoqMEO6QQm6WcSuqm2K2Yw6OCsMiecE
YR4dsXoOgE8SKwaGueIykEeaKokqckacieiMMqk6kOySAmQg4mUmssCKcQCmW6ESqU6
ZxzQwlH7WuCMeauaOE2iG240gmCWgcqMyQCq02Iy4aEcE8Cw8wSUe6cguQUu0CMa0E6a
P1lCXbizgiu84QwGUs26OSE8GOAGIomEComUggeuUco6GQmKk848o2yoOYmm8O8yAaswe
3v7gFZnXzOwGQYOMSWmWsYSuUMcosgUWO2CUGIG4we6Mm8c6UU2ykIikU4iAAmAYu88ckc
shbsDxrTNIoeGiuGAGc468o2uQOIYmqce4Ga60uuwYK0yI6CEsYI6IQ4eCyMcCUkoMewYiE
mGz5QRxKpMiUioIOkqKGIOiQEOWygKsYwUw08SOE2uAK4SQsmkeSqGS6QekOMMYUmKOgo2Oy
4i7wRnCXSoOeQWAQC8wKMaqY8yUQCyq8eiQ2S2EU2AAm0SKQKMiAqgiUaKCqIgKQwIUsAUgGu
8is6AP4KpqKeW2KO4eUmCyw2sgWAyooUA2QI66KMyyeqUKo6AOUKOwAAIKmqCIM6AWO8MwSsY
J7rLm8GzYYs0GkOgwMyU6Y4YcyO8EW6CaG2UUsGQ6kiA6SkIgmcUmWAiOkwY0MwkeWywk4W4Ic0
1C5lu0V4AgwoSIsU2QQA4euasiiUmcaIgCiaSqWKKos0s6MgwUUUe6ewQm8CU8wWu8gSmIqKqGIU
eiiPQgyJEIGMYUcISYy8aEYUcewSUGocAgOIcsyYiSMUu4QiQcc8kyyEUqyom4OAs00cmEAg0aOce
lq3CoBvrrMQOmS2YckwYcgqwOuQ4gEyq2GO8Ge4Amyw2AUW4IMIu6oig0My6sGuaOWA0EiECeUOoku
iik2dMq4jCYyUWyUsm44EoMyMCauyEEsqE8EYSoEkyW820KQoSgwIyqKIAWG0KcYsCASo2WUcW4WmAa

So you are running bases.toBase62(num) agains a very big num, which means that it will be as long as a float, that is, 64 bits, and the rest will be zero padded, so the bytes you are getting are not really random.

they are still random not matter what :)