How Random Number Generators Work

Pseudo-random: a formula and a seed

Most everyday randomness comes from a pseudo-random number generator (PRNG). It starts with a number called the seed and repeatedly applies a mathematical formula, each output feeding the next. The stream of results passes statistical tests for randomness — even spread, no obvious patterns — so for almost all practical purposes it behaves like chance.

But it's entirely deterministic. Feed in the same seed and you get the exact same sequence, every time. That's not a bug; it's sometimes exactly what you want. A game that seeds its world from "1234" can recreate the identical map for every player, and a scientist can rerun a simulation precisely by reusing the seed. Reproducibility is the upside of pseudo-randomness.

Why Math.random isn't secure

In a browser, Math.random() is a PRNG. It's fast, well-distributed and perfect for shuffling a playlist, rolling dice, or picking a colour. What it is not is unpredictable to a determined observer. Its internal state can, in principle, be reconstructed from enough outputs, after which every future number is foreseeable. That makes it disqualified for anything security-sensitive: passwords, session tokens, API keys, password-reset codes, or shuffling a real-money card game.

True & cryptographic randomness

A true random number generator draws from physical entropy — electronic noise, timing jitter, sensor static — which is genuinely unpredictable and not reproducible. Operating systems gather this entropy into a pool. A cryptographically secure PRNG (CSPRNG) then stretches that high-quality seed into a long stream that no one can predict or run backwards, even knowing past outputs.

In the browser this is crypto.getRandomValues. It's what the generator on this site uses when you tick Crypto-secure. The numbers still come out instantly, but they're seeded from the operating system's entropy and are safe for codes that protect something. The trade-off is you lose reproducibility — which is the whole point for a secret.

From a 0–1 number to your range

Both sources hand back a fraction between 0 and 1 (or raw bytes). To turn that into "a number between min and max", you scale and shift it. For inclusive integers the standard formula is:

The + 1 is what makes the maximum reachable; the leading min + shifts the range so it starts where you asked. One subtlety: naively folding raw random bytes into a range that doesn't divide evenly introduces a tiny bias toward lower values, so careful generators discard the few out-of-range samples (rejection sampling). For everyday ranges the effect is negligible, but it's why "do it properly" matters when fairness counts.

Why short runs look "not random"

People often distrust a good generator because it produced two of the same number, or a little cluster. That instinct is wrong. Genuine randomness is lumpy — streaks and repeats are expected over small samples, and a result that looked perfectly even (1, 2, 3, 4, 5…) would actually be the suspicious one. Uniformity only emerges over thousands of draws. So a few clustered results aren't a flaw; they're evidence the generator isn't artificially smoothing things out.