diff --git a/tool/net/help.txt b/tool/net/help.txt
index 1e087b29f..6ae58e8a5 100644
--- a/tool/net/help.txt
+++ b/tool/net/help.txt
@@ -698,6 +698,10 @@ FUNCTIONS
            Returns the request HTTP protocol version, which can be 9 for
            HTTP/0.9, 10 for HTTP/1.0, or 11 for HTTP/1.1.
 
+   GetRandomBytes([length:int]) → str
+           Returns string with the specified number of random bytes (1..256).
+           If no length is specified, then the string of length 16 is returned.
+
    GetRedbeanVersion() → int
            Returns the Redbean version in the format 0xMMmmpp, with major (MM),
            minor (mm), and patch (pp) versions encoded. The version value 1.4
@@ -850,7 +854,7 @@ FUNCTIONS
            If this option is programmed then redbean will not transmit a
            Server Name Indicator (SNI) when performing Fetch() requests.
 
-   ProgramSslPresharedKey(key:str, identity:str)
+   ProgramSslPresharedKey(key:str,identity:str)
            This function can be used to enable the PSK ciphersuites
            which simplify SSL and enhance its performance in controlled
            environments. `key` may contain 1..32 bytes of random binary
diff --git a/tool/net/redbean.c b/tool/net/redbean.c
index 371886586..fb3abd70e 100644
--- a/tool/net/redbean.c
+++ b/tool/net/redbean.c
@@ -4471,6 +4471,21 @@ static int LuaSha512(lua_State *L) {
   return LuaHasher(L, 64, mbedtls_sha512_ret_512);
 }
 
+static int LuaGetRandomBytes(lua_State *L) {
+  char *p;
+  size_t n = luaL_optinteger(L, 1, 16);
+  if (!(n > 0 && n <= 256)) {
+    luaL_argerror(L, 1, "not in range 1..256");
+    unreachable;
+  }
+
+  p = malloc(n);
+  CHECK_EQ(n, getrandom(p, n, 0));
+  lua_pushlstring(L, p, n);
+  free(p);
+  return 1;
+}
+
 static int LuaGetHttpReason(lua_State *L) {
   lua_pushstring(L, GetHttpReason(luaL_checkinteger(L, 1)));
   return 1;
@@ -5153,6 +5168,7 @@ static const luaL_Reg kLuaFuncs[] = {
     {"GetPath", LuaGetPath},                                    //
     {"GetPayload", LuaGetPayload},                              //
     {"GetPort", LuaGetPort},                                    //
+    {"GetRandomBytes", LuaGetRandomBytes},                      //
     {"GetRedbeanVersion", LuaGetRedbeanVersion},                //
     {"GetRemoteAddr", LuaGetRemoteAddr},                        //
     {"GetScheme", LuaGetScheme},                                //