title: randomBytes vs pseudoRandomBytes
body: <p>In what situations is it acceptable (from a security standpoint) to use node's <a href="http://nodejs.org/api/crypto.html#crypto_crypto_pseudorandombytes_size_callback" rel="noreferrer"><code>crypto.pseudoRandomBytes</code></a> instead of the cryptographically-strong <a href="http://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback" rel="noreferrer"><code>crypto.randomBytes</code></a>?</p>
  
  <p><s>I assume <code>pseudoRandomBytes</code> performs better at the expense of being more predictable</s> (<a href="https://stackoverflow.com/a/18131768/201952">incorrect</a>), but the docs don't really have much to say about how less-strong it is.</p>
  
  <p>Specifically, I'm wondering if I'm ok using <code>pseudoRandomBytes</code> to generate a CSRF token.</p>