Generate random value

I need a random token for a password-reset link for user 16742. Generate a cryptographically secure random string of 32 URL-safe characters, base64-url encoded, and attach it to resetTokens with an expiry 15 minutes from now. Return the token so I can send it in the email.

Before I put random tokens into production, make the generation easy to audit: show the entropy bits, write a one-line comment explaining why the method is cryptographically secure, and flag any uses of Math.random or non-cryptographic APIs. Also provide a deterministic fallback for tests that can be toggled without changing the production path.

I just generated a password-reset token for user 16742 and a support case says the token matched another recent token. I suspect a non-cryptographic PRNG slipped into the code path, or I accidentally seeded a deterministic routine for tests. I can’t tell whether the bug is in token creation, storage, or a test harness. What is the most likely cause and the immediate code checks I should run to confirm and fix it now?

Over time I see intermittent token collisions or predictable tokens in logs and it costs hours in incident triage. I keep using ad-hoc token helpers that are convenient for dev but unsafe for prod. What practice and minimal tooling change will stop these incidents, and how should I handle testability without weakening security in production?