True Randomness vs Pseudo-Randomness — Why the Source Matters
Not all random numbers are equal. JavaScript's Math.random() produces numbers that look random but are fully determined by an initial seed — predictable to anyone who can observe enough outputs. This generator uses window.crypto.getRandomValues(), the browser's Cryptographically Secure Pseudo-Random Number Generator (CSPRNG), which draws from hardware entropy and is suitable for security-sensitive applications, sampling, and any context requiring genuine unpredictability.
Simple modulo reduction introduces bias (modulo bias). This tool uses rejection sampling to ensure every value in the range has exactly equal probability.
How CSPRNG Works in the Browser
The Web Crypto API's getRandomValues() function asks the operating system for bytes drawn from its entropy pool — a buffer continuously filled with unpredictable data from hardware sources: CPU execution timing variations, interrupt timing, hardware random number generator circuits (Intel RDRAND, AMD equivalent), and other physical noise. The OS mixes these sources through a cryptographic conditioner (typically SHA-256 or AES-CTR-DRBG) to produce uniformly distributed bytes. These bytes are then used to generate numbers in your requested range.
Generating Unbiased Numbers in a Range
Mapping raw random bytes to a specific range [min, max] requires care. The naive approach — take a random number modulo range_size — introduces modulo bias: values near the bottom of the range are slightly more probable than others when the range does not divide evenly into the raw output space. This tool uses rejection sampling: generate a candidate value; if it falls in the unbiased region of the raw output space, use it; otherwise discard and try again. This guarantees every value in your range has exactly equal probability.
Common Applications
Random number generation underlies far more than games and lotteries. Monte Carlo simulations use millions of random samples to approximate integrals, option prices, and physical processes. Statistical sampling uses randomness to select representative subsets of a population. A/B test assignment randomly routes users to variants. Cryptography uses random numbers as keys, nonces, and initialization vectors — where CSPRNG is mandatory. Procedural generation in games uses seeded PRNGs to create reproducible worlds from a starting seed.
Generating Unique Sets — Sampling Without Replacement
When you need N unique random values from a range — as in a lottery draw where the same ball cannot be drawn twice — the algorithm is a Fisher-Yates shuffle. Initialize an array of the full range, then iteratively swap each position with a randomly chosen position at or after it. The first N positions of the shuffled result are your unique random sample. This runs in O(N) time and guarantees no value appears twice.
Frequently Asked Questions
Is this truly random?
Yes, in the cryptographic sense. This tool uses window.crypto.getRandomValues(), which draws from the operating system's hardware entropy pool — CPU timing jitter, hardware interrupts, and other physical noise sources. This is a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG): its output is computationally indistinguishable from true randomness and cannot be predicted even if an attacker observes all previous outputs.
What is the difference between Math.random() and crypto.getRandomValues()?
Math.random() is a pseudo-random number generator (PRNG) — it uses a deterministic mathematical algorithm (typically xorshift128+) seeded at startup. It is fast and statistically uniform for most purposes, but predictable if an attacker knows the seed or observes enough outputs. crypto.getRandomValues() draws from hardware entropy and is designed so that knowing all previous outputs does not help predict the next one. For security-sensitive use — tokens, keys, sampling in audited contexts — always use the CSPRNG.
What are random numbers used for?
Applications span many fields: Monte Carlo simulations, statistical sampling and A/B test assignment, game mechanics and dice rolls, generating test data, randomizing survey order, lottery draws and prize selection, cryptographic key generation, nonce generation, and fair coin-flip decisions. The appropriate randomness source differs: simulations need speed and statistical quality; security applications need CSPRNG.
Can I generate a set of unique random numbers with no repeats?
Yes — this is called sampling without replacement. The algorithm generates a shuffled permutation of the range using a Fisher-Yates shuffle (applied using CSPRNG), then takes the first N values. Each value in the range appears at most once in the output, making this suitable for lottery draws, random ordering of lists, and sampling from a population without replacement.
What is a pseudo-random number generator (PRNG)?
A PRNG uses a mathematical algorithm initialized with a seed value to produce a sequence of numbers that appear statistically random. Given the same seed, the sequence is fully reproducible — useful for simulations and games that need replay capability. The limitation: an attacker who knows the seed knows all future outputs. CSPRNGs are PRNGs specifically engineered so that the internal state cannot be inferred from observed outputs, even given unlimited computation.
How do lottery draws actually work?
Legitimate lottery draws use Hardware Random Number Generators (HRNGs) — physical devices that measure quantum noise, radioactive decay timing, or photon arrival events — to produce verified true randomness. The outputs are typically certified by an independent auditor. Many online lottery and gaming systems use CSPRNGs with publicly posted seeds, allowing post-draw verification. This tool's CSPRNG is equivalent in quality for any practical non-audited application.