"use strict";

var charsNumbers = '0123456789';
var charsLower   = 'abcdefghijklmnopqrstuvwxyz';
var charsUpper   = charsLower.toUpperCase();

var chars = charsNumbers + charsLower + charsUpper;

exports.generate = function(length) {

  if (!length) length = 32;

  var string = '';

  for (var i = 0; i < length; i++) {
    var randomNumber = Math.floor(Math.random() * chars.length);
    string += chars.substring(randomNumber, randomNumber + 1);
  }

  return string;
}

"use strict";

var charsNumbers = '0123456789';
var charsLower   = 'abcdefghijklmnopqrstuvwxyz';
var charsUpper   = charsLower.toUpperCase();

var crypto = require('crypto');

var chars = charsNumbers + charsLower + charsUpper;

exports.generate = function(length) {

  length = length || 32;

  var string = '';

  while(string.length < length){
    var bf = crypto.randomBytes(length);
    for(var i = 0; i < bf.length; i++){
      var index = bf.readUInt8(i)%chars.length;
      string += chars.charAt(index);
    }
  }

  return string;
}

Use crypto.randomBytes instead of Math.random.
Use crypto.randomBytes instead of Math.random.

Math.random is not cryptographically secure. Since that the number one
google result for "node random string" is this, it needs to be secure.
