Is there a practical attack for this usage? The attacker would need to have a bunch of your passwords already?<p>EDIT: Not that I&#x27;m justifying using Math.random, I just don&#x27;t see why you so strongly recommend against using this tool.