True Randomness vs. Pseudo-Randomness: What Happens When You Click "Generate"

Computers can't generate true randomness on their own

Here's a fact that surprises a lot of people: a computer, on its own, is a purely deterministic machine — given the same input, it always produces the same output. So how does it generate something that looks random at all? The classic approach is a Pseudo-Random Number Generator (PRNG): an algorithm that takes a starting value (a "seed") and runs it through a mathematical formula to produce a long sequence of numbers that looks random and passes statistical randomness tests, but is technically 100% predictable if you know the seed and the formula.

Why that's a problem for security

Basic PRNGs (including Math.random() in JavaScript) are fine for games, simulations, or picking a random background color — situations where nobody is trying to predict or exploit the outcome. But they're unsuitable for anything security-sensitive, like generating a password or an encryption key, because if an attacker can guess or narrow down the seed, they can potentially predict every "random" value that generator will ever produce.

Where actual randomness comes from

Modern operating systems gather genuine physical randomness from unpredictable real-world sources — tiny variations in hardware timing, mouse movement jitter, disk I/O timing, and dedicated hardware random number generators built into many modern CPUs. This pool of real-world entropy feeds a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG), which browsers expose to websites through an API called crypto.getRandomValues(). It's still technically an algorithm, but it's continuously fed with real unpredictability and specifically designed so that past or future outputs can't be predicted even by someone who has seen other outputs from it.

Does it matter for picking a raffle winner?

For low-stakes randomness — games, sampling, casual decision-making — the difference between a PRNG and a CSPRNG is invisible in practice. It starts to matter the moment the outcome has real value to someone who might want to predict or manipulate it: passwords, lottery-style drawings with a prize, security tokens, or cryptographic keys.

Our Random Number Generator uses crypto.getRandomValues() rather than Math.random(), along with a bias-free selection method so that every number in your chosen range has an equal chance of appearing, even near the edges of the range.