Understanding True Randomness, Pseudorandom Numbers, and Cryptographic Security

In computer science, generating a genuinely unpredictable number is surprisingly difficult. Computers are deterministic machines designed to produce exact, repeatable results for every instruction they execute. Yet digital security—from HTTPS encryption and SSH keys to lottery draws and authentication tokens—depends completely upon uncrackable randomness.

PRNG vs CSPRNG: What Is the Difference?

Random number generators in software generally fall into two broad architectures:

1. Pseudorandom Number Generators (PRNG): Standard programming functions like Math.random() in JavaScript or rand() in C are PRNGs. They start from an initial mathematical "seed" value and apply formulas (like Linear Congruential Generators or Mersenne Twister) to output a sequence of numbers that appear random. However, if an attacker discovers or guesses the seed, every subsequent number in the sequence is completely predictable. PRNGs are fast and great for visual animations or video games, but catastrophic for security.

2. Cryptographically Secure Pseudorandom Number Generators (CSPRNG): CSPRNGs (such as crypto.getRandomValues() in modern web browsers) gather continuous physical entropy from hardware sources: mouse movements, microsecond thermal fluctuations, network timing interrupts, and dedicated hardware security modules (like Intel RDRAND or Apple Secure Enclave). The generated entropy cannot be reversed or predicted even with massive computing power.

Why Modulo Bias Ruins Unbiased Randomness

A common mistake made by junior developers when mapping a raw random byte to a smaller range is using the modulo operator (%):

// BIASED implementation:
const raw = crypto.getRandomValues(new Uint8Array(1))[0]; // 0 to 255
const roll = (raw % 6) + 1; // Dice roll from 1 to 6

Because 256 is not evenly divisible by 6 (256 = 42 × 6 + 4), the numbers 1, 2, 3, and 4 will be generated 43 times, while 5 and 6 will only be generated 42 times! Over millions of iterations, this statistical skew—known as modulo bias—gives unfair advantages in games and creates exploitable vulnerabilities in cryptographic keys.

To achieve mathematically pure, unbiased distributions, developers must use rejection sampling: discarding numbers that fall into the non-divisible remainder and re-rolling until an unbiased value is produced.

Our free Random Number Generator Tool uses native browser Web Cryptography with verified rejection sampling, ensuring that every dice roll, lottery pick, and PIN generation is 100% fair, unbiased, and cryptographically secure.