random string masking in javascript

random_masking.js

String.prototype.replaceAt=function(index, char) {
    return this.substr(0, index) + char + this.substr(index+char.length);
}
  
var REPLACEMENT_CHAR = "*";

var TO = 5;
var FROM = 4;
  
var str = "Hello World";

var strLen = str.length;

var rnd = Math.floor((Math.random()*(TO - FROM + 1)) + FROM);

for(i = 0; i < strLen; i++){
    if((i+1) >= rnd && ((i+1) % rnd) == 0 && str.charAt(i) != " " && str.charAt(i) != REPLACEMENT_CHAR)
    {
        str = str.replaceAt(i, REPLACEMENT_CHAR);
    }
}

alert(str);