diff --git a/ws/mod.ts b/ws/mod.ts
index 5a8f0bd2e5fc..3128a88b5656 100644
--- a/ws/mod.ts
+++ b/ws/mod.ts
@@ -457,7 +457,7 @@ const kSecChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-.~_";
 export function createSecKey(): string {
   let key = "";
   for (let i = 0; i < 16; i++) {
-    const j = Math.round(Math.random() * kSecChars.length);
+    const j = Math.floor(Math.random() * kSecChars.length);
     key += kSecChars[j];
   }
   return btoa(key);
diff --git a/ws/test.ts b/ws/test.ts
index 5a0ff99298b6..3f5475c80c0a 100644
--- a/ws/test.ts
+++ b/ws/test.ts
@@ -8,6 +8,7 @@ import {
   acceptable,
   connectWebSocket,
   createSecAccept,
+  createSecKey,
   handshake,
   OpCode,
   readFrame,
@@ -328,6 +329,13 @@ test("WebSocket.send(), WebSocket.ping() should be exclusive", async (): Promise
   assertEquals(bytes.equal(third.payload, new Uint8Array([3])), true);
 });
 
+test(function createSecKeyHasCorrectLength(): void {
+  // Note: relies on --seed=86 being passed to deno to reproduce failure in
+  // #4063.
+  const secKey = createSecKey();
+  assertEquals(atob(secKey).length, 16);
+});
+
 test("WebSocket should throw SocketClosedError when peer closed connection without close frame", async () => {
   const buf = new Buffer();
   const eofReader: Deno.Reader = {