that is kind of scary. i had a look over the code and the problem seems not obvious. the only issue i saw was multiple instances of SecureRandom share the same

that is kind of scary. i had a look over the code and the problem seems not obvious. the only issue i saw was multiple instances of SecureRandom share the same state which could cause some problems if you do [1]: x = new SecureRandom(); y = new SecureRandom(); y.setSeed(predictable); x.generateBytes(zz); and also i think the seed is thread local so you can have: x = new SecureRandom(); x.setSeed(xxx); then on another thread x.generateBytes() won't do what you think it will do. i don't think this would cause dupes because i assume apps are isolated from each other and these apps aren't calling setSeed... [1] this is assuming android people haven't patched openssl to have different behaviour and also setSeed might be safe in openssl because it uses the value to augment and not replace the state.