How it works
Every byte comes from crypto.getRandomValues, so the output is suitable for session tokens, API secrets, and salts. 16 bytes (128 bits) covers most tokens, 32 bytes matches a SHA-256 key, and nothing you generate here leaves the browser.