It is secure do accounts just with web3.eth.accounts.create() ? (entropy)

Question

const Web3 = require('web3');

let url = 'infuralink';
let web3 = new Web3(url);
console.log(web3.eth.accounts.create());

This is the code of many tutorials for do a key pair. it is completely secure or do I need to pass a parameter to have enough entropy?

Answer 1

Yes it is secure. If you don't pass entropy to it, it will use randomhex, see Web3 docs. That uses the secure crypto.randomBytes function which is pretty secure. It's just a wrapper around OpenSSL's RAND_bytes().