How to Generate (Truly) Random Numbers

Math.random() is fine for shuffling a card game. It's catastrophically wrong for choosing a giveaway winner, seeding a password, or anything with real stakes. Here's what randomness actually means — and when to use which tool.

There's No Such Thing as "Random"

All software randomness is pseudo-random. A deterministic algorithm produces numbers that appear random but come from a predictable sequence. The difference between "good enough" randomness and cryptographic randomness is how hard that sequence is to predict.

Math.random(): The Everyday Option

JavaScript's Math.random() uses algorithms like Xoroshiro128+ or PCG (depending on the browser). These produce statistically random-looking output. For casual purposes — shuffling a list, picking a random playlist song, generating decorative motion — they're fine.

But they have two critical properties that make them unsuitable for serious uses:

1. They're seeded with timing-based values, making them potentially predictable
2. Observing enough outputs lets you predict future outputs — in some cases with alarming efficiency

This is why never use Math.random() for:

• Password generation
• Cryptographic keys
• Session tokens
• Lottery draws with any financial stake
• Anything where manipulation of output causes real harm

Web Crypto: The Secure Option

The crypto.getRandomValues() API uses the operating system's cryptographic random source. On Linux, it's /dev/urandom. On Windows, it's CryptGenRandom. These draw from pools of entropy harvested from hardware events — keyboard timing, mouse movement, disk seek times, network packet arrivals, thermal noise.

The Random Number Generator tool uses crypto.getRandomValues() by default. This is suitable for:

• Giveaway winner selection
• Generating random seeds for other systems
• Sampling for statistical analysis
• Randomized test case generation
• Any "serious" randomness need

The only true randomness comes from hardware sources (radioactive decay, thermal noise, quantum effects). Without specialized hardware, crypto.getRandomValues() is as close as browser JavaScript can get.

Unique vs. Duplicate: A Statistical Difference

When you generate 10 random numbers from 1-100:

• With duplicates allowed: each number is independent. Same number can appear twice.
• Without duplicates: numbers act like drawing cards from a deck. Each draw reduces the pool.

For a lottery or giveaway where each ticket represents a distinct person, you want unique numbers. Otherwise you might draw the same winner twice.

The birthday paradox applies: even with "random" numbers in a wide range, collisions happen more often than you'd expect. Pulling 23 random people from any group has a 50% chance that two share a birthday. If you need guaranteed uniqueness, enable the "No duplicates" option.

Common Use Cases

Giveaway winner selection

1. Number all entries (Entry 1, Entry 2, ..., Entry N).
2. Generate 1 random integer from 1 to N.
3. That's your winner.
4. For multiple winners, use "No duplicates" mode.

Always publish your method. Transparency protects you from accusations of bias.

Random sampling for surveys

Need 50 random customers from your list of 5,000? Number them, generate 50 unique random integers from 1-5000, and survey those.

Seeding password suggestions

Don't use this tool to generate passwords directly — use our Password Generator which combines randomness with character class rules. But you can use random numbers as part of a combined password scheme.

Game design and dice rolls

Simulating dice, card draws, random encounters. Even for games with real-money stakes, cryptographic randomness is overkill — but it's free and prevents any accusation of tampering.

Distribution and Fairness

A uniform random distribution means every number in the range is equally likely. If you generate 10,000 numbers from 1-10, you should see approximately 1,000 of each value. The tool produces uniform distribution across the specified range.

If you need non-uniform distributions (normal/Gaussian, exponential, weighted), you'd need a different tool or custom math. The standard normal distribution can be approximated from uniform random numbers using the Box-Muller transform — but this is usually done in code, not through a general-purpose generator.

Verifying Randomness

Generate 1,000 numbers and graph the distribution. If one value appears 3x more often than others, something's wrong. If the distribution is perfectly flat, your sample size is probably just large enough. True randomness has some wobble.

The NIST Statistical Test Suite is the gold standard for testing randomness quality. For casual verification, the browser's crypto.getRandomValues() has been extensively tested and is considered safe.

Frequently Asked Questions

Published April 2026 by Derek Giordano