diff --git a/lib/rand/random.go b/lib/rand/random.go
index 98ff76f53..d596aec12 100644
--- a/lib/rand/random.go
+++ b/lib/rand/random.go
@@ -12,6 +12,7 @@ import (
 	"io"
 	mathRand "math/rand"
 	"reflect"
+	"strings"
 )
 
 // Reader is the standard crypto/rand.Reader with added buffering.
@@ -37,11 +38,13 @@ var (
 // (taken from randomCharset) of the specified length. The returned string
 // contains ~5.8 bits of entropy per character, due to the character set used.
 func String(l int) string {
-	bs := make([]byte, l)
-	for i := range bs {
-		bs[i] = randomCharset[defaultSecureRand.Intn(len(randomCharset))]
+	var sb strings.Builder
+	sb.Grow(l)
+
+	for i := 0; i < l; i++ {
+		sb.WriteByte(randomCharset[defaultSecureRand.Intn(len(randomCharset))])
 	}
-	return string(bs)
+	return sb.String()
 }
 
 // Int63 returns a cryptographically secure random int63.
diff --git a/lib/rand/random_test.go b/lib/rand/random_test.go
index 4a19eb828..24569caf5 100644
--- a/lib/rand/random_test.go
+++ b/lib/rand/random_test.go
@@ -44,3 +44,10 @@ func TestRandomUint64(t *testing.T) {
 		}
 	}
 }
+
+func BenchmarkString(b *testing.B) {
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		String(32)
+	}
+}
diff --git a/lib/rand/securesource.go b/lib/rand/securesource.go
index bc2c87b85..caa1e2c42 100644
--- a/lib/rand/securesource.go
+++ b/lib/rand/securesource.go
@@ -21,6 +21,7 @@ import (
 type secureSource struct {
 	rd  io.Reader
 	mut sync.Mutex
+	buf [8]byte
 }
 
 func newSecureSource() *secureSource {
@@ -47,18 +48,15 @@ func (s *secureSource) Read(p []byte) (int, error) {
 }
 
 func (s *secureSource) Uint64() uint64 {
-	var buf [8]byte
-
 	// Read eight bytes of entropy from the buffered, secure random number
 	// generator. The buffered reader isn't concurrency safe, so we lock
 	// around that.
 	s.mut.Lock()
-	_, err := io.ReadFull(s.rd, buf[:])
-	s.mut.Unlock()
+	defer s.mut.Unlock()
+
+	_, err := io.ReadFull(s.rd, s.buf[:])
 	if err != nil {
 		panic("randomness failure: " + err.Error())
 	}
-
-	// Grab those bytes as an uint64
-	return binary.BigEndian.Uint64(buf[:])
+	return binary.LittleEndian.Uint64(s.buf[:])
 }