API ArcadeISSUE #16 of 23

crypto api · randomUUID · subtle.digest

ApiaVSLegacy Larry

Apia saysThe Web Crypto API provides secure randomness and hashing — randomUUID and subtle.digest.

crypto.randomUUID() generates a v4 UUID; crypto.getRandomValues(arr) fills a typed array with cryptographically secure randomness (never use Math.random for security). crypto.subtle handles hashing (digest), signing, and encryption — all async and HTTPS-only. Don't roll your own crypto; use these primitives.

Power-ups you unlock

crypto.randomUUID() → secure v4 UUID
getRandomValues for secure randomness
crypto.subtle.digest/sign/encrypt (async)
HTTPS-only; never use Math.random for security

Legacy Larry attacks — common mistakes

Using Math.random for tokens/IDs
Rolling your own hashing/encryption
Forgetting subtle.* is async and secure-context only

Boss battleGenerate a secure UUID and hash a string with subtle.digest (SHA-256).

Example code

<!doctype html><html><head><meta charset="utf-8"></head>
<body style="background:#06040d;color:#e6e0ff;font-family:monospace;padding:20px"><pre id="o"></pre>
<script>(async()=>{const id=crypto.randomUUID();const buf=await crypto.subtle.digest('SHA-256',new TextEncoder().encode('hi'));const hex=[...new Uint8Array(buf)].slice(0,4).map(b=>b.toString(16).padStart(2,'0')).join('');document.getElementById('o').textContent='uuid='+id+'\nsha256(hi)='+hex+'…';})();</script></body></html>

▶ Open the interactive comic issue

‹ Worklets · Paint · Audio · Animation Webauthn · Passkeys · Biometrics ›