diff --git a/app.py b/app.py
index f9a4b09..085ece0 100644
--- a/app.py
+++ b/app.py
@@ -28,7 +28,7 @@ rate_limits: dict[str, list] = defaultdict(list)
 # Connection tracking: {ip: connection_count}
 connections_per_ip: dict[str, int] = defaultdict(int)
 
-def random_id(n: int = 4) -> str:
+def random_id(n: int = 8) -> str:
     alphabet = string.ascii_lowercase + string.digits
     return "".join(secrets.choice(alphabet) for _ in range(n))
 
@@ -242,7 +242,12 @@ HTML = """<!doctype html>
 <script>
 const $ = s => document.querySelector(s);
 const proto = location.protocol === "https:" ? "wss" : "ws";
-const rand = () => Math.random().toString(36).slice(2, 6); // 4 chars
+const rand = () => {
+  const arr = new Uint8Array(8);
+  crypto.getRandomValues(arr);
+  const a = "abcdefghijklmnopqrstuvwxyz0123456789";
+  return Array.from(arr, b => a[b % 36]).join("");
+};
 
 // Theme
 function applyTheme(dark) {
