Ask a computer for a random number and it will give you one instantly — and it will be lying. Computers are deterministic machines: the same program with the same inputs always produces the same outputs. Genuine unpredictability has to be smuggled in from outside, and the story of how engineers do it touches physics, cryptography and the reason your passwords need better randomness than your games do.
This is that story: why determinism fights randomness, how fake randomness works, where real randomness comes from, and which kind you should trust with what.
Why determinism is the enemy of randomness
A computer executes instructions in perfect order. There is no dice-rolling instruction, no coin flip in the processor — every bit that comes out was determined by bits that went in. This determinism is the whole virtue of computing (your bank balance must not depend on chance), but it means randomness cannot be generated from nothing. It must be harvested.
The distinction that follows everything else: pseudorandomness is a deterministic recipe that looks random; true randomness comes from physical processes nobody can predict. Most of what you meet daily is the fake kind, and for most purposes that is fine — until security is involved.
Pseudorandom generators: good enough, mostly
A pseudorandom number generator (PRNG) starts from a seed — one initial number — and applies arithmetic that scrambles it into a long sequence that passes statistical tests for randomness. Same seed, same sequence, every time. That reproducibility is a feature: simulations and games can be replayed exactly, and procedural worlds (like Minecraft's terrain) are generated from a single seed you can share.
The catch is predictability. Simple PRNGs, including the famous Mersenne Twister behind many languages' default random(), can be reverse-engineered: observe enough outputs and you can compute the seed, then predict every future number. Fine for shuffling a playlist; catastrophic for generating a password or a lottery draw.
History is full of warnings. In 2008, a Debian maintainer accidentally disabled almost all entropy gathering in OpenSSL, leaving process IDs — a number between 1 and 32768 — as effectively the only seed. Every cryptographic key generated on affected systems for two years came from a pool of about 32,000 possibilities, and attackers could simply try them all. The bug was a two-line change; the cleanup took years. Randomness failures are quiet until they are catastrophic.
True randomness: stealing noise from the universe
Real unpredictability lives in physics: thermal noise in resistors, atmospheric static, the exact timing of your keystrokes, quantum effects. Operating systems gather such events into an entropy pool — a reservoir of genuine unpredictability — and hand it out sparingly to programs that ask.
Because physical harvesting is slow, systems stretch it: a small amount of true randomness seeds a cryptographically secure generator, which then produces an unlimited stream that remains unpredictable even to attackers who see part of it. Your OS does this continuously in the background; every TLS connection and every SSH key you have ever made drank from this well.
crypto.getRandomValues: randomness you can trust
In the browser, Math.random() is the fast, predictable PRNG — fine for games and animations, never for secrets. The trustworthy alternative is crypto.getRandomValues(), which draws from the operating system's cryptographic generator. Password generators, UUID tools and anything security-adjacent on a well-built site use it exclusively.
The rule is simple and absolute: if an attacker predicting the number would harm you, use the crypto API. Passwords, tokens, salts, shuffling for anything with stakes — all crypto-grade. Everything else can take the fast path.
Why it matters: passwords, lotteries and shuffles
Password strength is measured in entropy — the attacker's uncertainty, counted in bits. A generator using crypto randomness with a 90-character pool gives each character about 6.5 bits of genuine surprise; one using a predictable PRNG gives near zero against a clever attacker, no matter how random the output looks. Looks mean nothing; the source is everything.
The stakes scale up fast. Online poker sites have been broken through predictable shuffles; lotteries use audited hardware generators precisely because the incentive to predict is enormous. Whenever money, secrets or fairness ride on a number, ask where the randomness came from — and accept only the cryptographic answer.
Frequently asked questions
Is Math.random() safe for generating passwords?
No — never. It is a fast, predictable PRNG designed for games and visual effects, and its output can be reverse-engineered. Password generators must use crypto.getRandomValues() (in browsers) or the OS cryptographic API, which draws from real entropy. If a password tool uses Math.random(), close the tab.
What is a seed?
The starting number of a pseudorandom generator. The entire output sequence is determined by it, which makes PRNGs reproducible — the same seed always gives the same stream. This is useful for testing and procedural generation, and exactly why seeds must be secret and unpredictable when security matters.
Can you really predict a PRNG's output?
For non-cryptographic PRNGs, yes, routinely. Given enough consecutive outputs, the internal state of generators like Mersenne Twister can be reconstructed, after which every future value is known. Cryptographically secure generators are designed so this reconstruction is computationally infeasible.
What does “entropy” mean here?
The amount of genuine unpredictability, measured in bits. A fair coin flip has one bit of entropy; a 128-bit cryptographic key has 128. Entropy is the currency of randomness: passwords, keys and tokens are only as strong as the entropy that went into them.
Conclusion
Randomness in computing is a spectrum, not a switch: fast-and-predictable for play, physics-harvested and cryptographically stretched for anything that matters. Knowing which kind sits behind a tool — a game, a password generator, a lottery — is the difference between randomness that merely looks right and randomness you can actually trust.