How Random Number Generators Work: PRNGs, CSPRNGs, and True Randomness

Random numbers power giveaways, games, simulations, passwords, and encryption. The surprising part is that most random numbers are not random at all. They are produced by a deterministic process that looks unpredictable from the outside.

Key takeaways

• A pseudo-random number generator (PRNG) turns a seed into a long, repeatable sequence.
• A cryptographically secure PRNG (CSPRNG) is designed so that past outputs cannot practically reveal future ones.
• True randomness comes from physical entropy sources, not from an algorithm alone.
• Browsers expose a CSPRNG through crypto.getRandomValues(), which is the right choice for everyday fair draws.
• Fairness also depends on how values are mapped to a range: biased modulo arithmetic can quietly favor some results.

Why randomness is harder than it looks

A computer follows instructions. If you run the same program twice with the same inputs, you normally get the same output. A random number generator must break that expectation without breaking the machine.

Software usually solves the problem in two layers. First, it collects a small amount of unpredictable data, called entropy, from sources such as timing jitter, keyboard events, or hardware noise. Second, it uses that entropy as a seed for an algorithm that produces a long stream of numbers. The stream looks random, but it is fully determined by the seed and the algorithm.

That design is useful. It makes random numbers reproducible for simulations and tests. It also means a poorly seeded generator can repeat the same sequence on different machines, which is why seed quality matters.

What a pseudo-random number generator does

A PRNG keeps an internal state. Each time you ask for a number, it transforms the state and returns part of the result. The transformation is usually fast and deterministic. Given the same starting state, the same sequence appears again.

Most PRNGs eventually repeat their state. The number of values before repetition is called the period. A long period is helpful, but it does not automatically make a generator secure. An attacker who can observe enough output may be able to reconstruct the internal state and predict future values.

PRNG versus CSPRNG

A general-purpose PRNG is optimized for speed and statistical quality. A CSPRNG is designed to resist prediction. It uses cryptographic primitives and is built so that learning one output should not reveal the next one.

JavaScript's Math.random() is not suitable for security-sensitive work. It is fast and convenient, but engines do not guarantee cryptographic quality. Browsers provide crypto.getRandomValues() for security-relevant randomness. It fills a typed array with random bytes using the platform's cryptographic source.

For passwords, tokens, fair draws with a prize, and anything an attacker might want to predict, use a CSPRNG. For a decorative animation or a rough simulation, a regular PRNG may be enough.

Where true randomness comes from

No software algorithm can create information out of nothing. True randomness enters the system through physical processes: radioactive decay, thermal noise, or the precise timing of user input. Operating systems collect these signals into an entropy pool and use them to seed cryptographic generators.

Modern operating systems and browsers blend entropy continuously. You do not need to wave your mouse to make a draw fair, but the system does need a healthy source of entropy during boot and after long periods without activity. This is one reason cryptographic generators are carefully engineered rather than improvised.

How the generators on this site work

The tools on this site use crypto.getRandomValues() in your browser. Results are generated locally and are not uploaded.

For integer ranges, the browser returns a 32-bit unsigned value. A naive approach uses the remainder after division, but that can introduce a small bias when the range does not divide evenly into the full 32-bit space. The generators use rejection sampling instead: values outside the unbiased region are discarded and redrawn. The result is a uniform distribution across the requested range.

Shuffles use the Fisher–Yates algorithm with secure random indices. Unlike a casual sort with a random comparator, Fisher–Yates produces every permutation with equal probability when the random indices are uniform.

What is random enough for your use case?

Use ordinary pseudo-randomness for animations, game art, or rough simulations where predictability has no cost. Use a CSPRNG for:

• Passwords and recovery codes.
• Giveaways, raffles, and auditions with a real prize.
• Random assignment of people to teams or groups.
• Tokens, session identifiers, and anything security-related.
• Any draw you may need to defend publicly.

For long-term cryptographic keys, use a dedicated key-management system rather than a website. Browser randomness is strong, but key lifecycle, storage, and access control matter just as much as the initial bits.

A simple fairness check

You can test a generator informally by running many draws and looking at the distribution. With a six-sided die, every face should appear roughly one sixth of the time. Short runs will vary, and streaks are normal. What matters is whether the process is unbiased over many trials and whether it is reproducible enough to audit.

For public draws, record the inputs, the settings, and the result. The record does more for trust than any claim of randomness.

Bottom line

Randomness is a chain of engineering decisions: entropy collection, algorithm choice, unbiased mapping, and transparent use. A good generator does not need to be mysterious. It needs to be unpredictable where it matters, documented where it is used, and honest about its limits.