True Randomness vs Pseudo-Random Numbers
Random numbers power lotteries, games, simulations, and cryptography. But not all randomness is equal — knowing the difference stops security bugs and unfair draws.
Pseudo-random generators
A pseudo-random number generator (PRNG) is an algorithm that produces a sequence of numbers that look random but are fully determined by a starting seed.
Given the same seed, a PRNG always outputs the same sequence. That makes them reproducible for testing but unsuitable for security.
Cryptographically-secure generators
A cryptographically-secure PRNG (CSPRNG) is a PRNG whose output cannot be predicted even if an attacker sees earlier outputs. Web browsers expose one via crypto.getRandomValues.
For passwords, tokens, keys, or anything an attacker could benefit from guessing, always use a CSPRNG.
True random sources
True randomness comes from physical processes — thermal noise, radioactive decay, or photon arrival times. Operating systems mix these into an entropy pool that seeds their CSPRNGs.
Producing a fair draw
To pick a random integer in a range without bias, avoid the naive 'modulo' shortcut on a raw random byte. Reject values that would skew the distribution and roll again.