+0 for having getrandbits(0) return 0. Conceptually, it is reasonable. Practically, it is a bit inconvenient because the ValueError may have to be moved upstream to the _randbelow() methods. -1 for getrandbytes(). That is feature creep and no user has requested it. Also, the name leads to a confusing API with getrandbits() returning arbitrary sized python ints and getrandbytes() returning bytes. Lastly, it mostly duplicates functionality already supplied by secrets.token_bytes(). If you really want this, open another tracker issue and don't derail the issue at hand.