xrpl.js now throws on invalid entropy when creating a wallet or seed

Victoria Shinder26 October 2026, 09:301 min read

The XRP Ledger's official JavaScript client, xrpl.js, shipped version 4.7.0 with a small but security-relevant change: Wallet.fromEntropy and generateSeed now throw on invalid entropy rather than proceeding with it. The fix (pull request #3487) is a backport to the 4.x line, and the release also bundles ripple-keypairs 2.1.0.

The reason this is worth more than its one-line changelog entry: entropy is the raw randomness a seed and its keys are derived from, and a seed-generation function that accepts bad entropy — too short, empty, or otherwise malformed — can hand back a wallet whose keys are weaker or more predictable than the caller believes. The dangerous version of that bug is the silent one, where the call returns a perfectly ordinary-looking wallet and the weakness only surfaces when funds move to an address an attacker could also derive. Making the function throw converts a silent correctness-and-security problem into a loud, immediate failure at the point of the mistake, which is exactly where a developer can see and fix it.

What it means

The lesson generalises past this one library. Any function that turns randomness into keys should treat weak input as an error, not a value, because the cost of being permissive is not a bad return value you notice but a weak key you do not. For teams building on the XRP Ledger in JavaScript, the practical action is narrow: upgrade to 4.7.0 (or the equivalent ripple-keypairs 2.1.0) so wallet creation fails fast on bad entropy, and audit any code that fed fromEntropy or generateSeed from a source whose length or quality was never checked. A throw you can see in testing is cheaper than a key you cannot.