Myths About /dev/urandom: The Truth You (Didn't) Know

If you've ever written code that generates random numbers, you've probably heard: "urandom is not safe, use /dev/random." Spoiler: it's a myth that lives in developers' minds more stubbornly than bugs in legacy code.

Let's clear it up. /dev/urandom doesn't block when entropy is low — that's where the confusion comes from. Back in the day (early Linux), it could indeed produce weak random numbers. But since kernel 4.8 (2016), /dev/urandom is initialized once at boot using a hardware entropy source. After that, it's just as cryptographically secure as /dev/random, but without blocking.

/dev/random, on the other hand, is a slowpoke. It can stall waiting for "enough entropy," which in production leads to panic and timeouts. Imagine your server hanging, waiting for a mouse move or a key press — and it's a cloud server with no mouse.

By the way, modern systems have /dev/random non-blocking too (since kernel 5.4), but myths persist. Next time someone at code review says "use /dev/random," you can politely point them to this article. Or just smile and throw /dev/urandom at them.

METABYTE studio comment: Security myths are like bugs: the older they are, the more persistent. In our projects, we verify these things so your production doesn't wait for entropy.