Computers Cannot Generate Random Numbers. What They Actually Produce Is Usually Good Enough Anyway.
Computers Cannot Generate Random Numbers. What They Actually Produce Is Usually Good Enough Anyway.
Computers cannot generate random numbers. Not truly. Every algorithm that produces what looks like randomness is actually a deterministic process: given the same starting conditions, it produces the same sequence every time. The word "random" in most software contexts means pseudorandom, which is mathematically indistinguishable from random for nearly all practical purposes but is not the same thing in a strict mathematical sense.
The distinction matters in cryptography, where an attacker who observes part of the output might be able to predict the rest. For selecting a giveaway winner, shuffling a playlist, or picking a number for a classroom exercise, the distinction does not matter at all. Understanding which situation you are in determines whether a simple random number generator is appropriate or whether you need something more specific.
Before computers could produce pseudorandom sequences efficiently, generating random numbers was a production problem that took years to solve.
In 1947, the RAND Corporation built a machine to tackle it: an electronic simulation of a roulette wheel that generated one random digit per second by gating a high-frequency pulse source through a five-place binary counter. The machine ran for years, generating digits that were then carefully tested and filtered for statistical properties before being considered valid.
The result was published in 1955 as a book titled "A Million Random Digits with 100,000 Normal Deviates." The book contained exactly what its title promised: one million random digits arranged in a table, plus 100,000 values from a normal distribution. Scientists, statisticians, and engineers could look up a random number the same way they used logarithm tables. The book was one of the last in a series of such publications, produced from the mid-1920s through the 1950s, and was reprinted in 2001. Modern analysis of the digits, conducted by RAND researchers and published on GitHub, found no evidence of bias or nonrandomness in the original dataset.
The RAND table represents the end of an era. By the late 1950s, digital computers were fast enough that pseudorandom algorithms could produce sequences more quickly than any physical process, making printed tables obsolete.
A pseudorandom number generator takes a starting value called a seed and applies a mathematical transformation to produce the next value. The next transformation uses that output as the new input, and the process continues. Because the transformation is deterministic, two generators started with the same seed produce identical sequences.
The seed is where apparent unpredictability enters the system. Most implementations seed from a value that changes continuously and is not easily observed by an attacker: the current time in nanoseconds, system hardware metrics, or a combination. If the seed is unpredictable, the resulting sequence is also unpredictable in practice, even though the algorithm itself is deterministic.
The linear congruential generator, one of the oldest pseudorandom algorithms, computes each value by multiplying the previous value by a constant, adding another constant, and taking the result modulo a third constant. The mathematical properties of this sequence depend on the choice of constants. Early implementations chose poorly and produced sequences with visible patterns.
The Mersenne Twister, published by Makoto Matsumoto and Takuji Nishimura in a paper titled "Mersenne Twister: A 623-Dimensionally Equidistributed Uniform Pseudo-Random Number Generator" in ACM Transactions on Modeling and Computer Simulation in January 1998, became the de facto standard for non-cryptographic random number generation. Its period, the number of values before the sequence repeats, is 2 to the power of 19,937 minus 1. This number is larger than the estimated number of atoms in the observable universe. For statistical and simulation purposes, the sequence is effectively non-repeating.
Python's built-in random module uses the Mersenne Twister. So does PHP, Ruby, R, and most scientific computing environments. The algorithm was adopted so widely because it is fast, has excellent statistical properties, and passes rigorous randomness test suites.
The property that makes the Mersenne Twister unsuitable for cryptography is the same property that makes it fast: given a sufficient sample of outputs, the internal state can be reconstructed, and future outputs can be predicted. This requires observing 624 consecutive 32-bit outputs from the generator, a feasible task for an attacker who can capture network traffic or query an API repeatedly.
For cryptography, the requirement is unpredictability: an attacker who has observed any amount of prior output must not be able to predict the next output with better than random chance. Cryptographically secure pseudorandom number generators (CSPRNGs) are designed to maintain this property. Common implementations include Fortuna (used in older versions of macOS and FreeBSD), ChaCha20 (used in Linux via the getrandom() system call since kernel 3.17), and the HMAC-DRBG algorithm specified in NIST SP 800-90A.
These cryptographic generators derive their initial entropy from hardware sources: thermal noise in CPU circuits, precise timing of hardware interrupts, and on modern Intel processors, the RDRAND instruction that accesses a hardware random number generator built into the processor itself.
JavaScript's crypto.getRandomValues() function uses the browser's CSPRNG, making it appropriate for security-sensitive purposes. JavaScript's Math.random() uses a non-cryptographic algorithm that varies by browser implementation and should not be used for anything security-related.
Selecting a winner from a list of entries is the most common non-cryptographic use case. A random number generator that picks an index into the list is sufficient when the goal is fairness in distribution, not security against manipulation. If the selection must be verifiable and tamper-proof, the method of seeding and the algorithm used become relevant, but for a social media giveaway or classroom drawing, any well-implemented pseudorandom generator is fine.
Statistical sampling uses random number generation to select representative subsets from larger populations. Survey research, quality control testing, A/B experiment assignment, and clinical trial randomization all use pseudorandom number generation. The Mersenne Twister and similar algorithms are appropriate for these uses because the statistical properties of the sequence matter more than unpredictability.
Simulation and games use random number generation to model uncertainty, vary outcomes, and drive procedural generation. Game engines implement pseudorandom generators with specific statistical properties to produce outcomes that feel natural. Some games save the seed value to allow reproducible scenarios.
Password generation and cryptographic key generation require CSPRNGs. A password generated from Math.random() in JavaScript is cryptographically weak. A password generated from crypto.getRandomValues() is not.
When using a random number generator for a specific range, how the range is implemented affects the distribution.
Generating a random integer between 1 and 100 is not the same as generating a random float between 0 and 1 and multiplying by 100 and rounding. The floating-point approach can produce slightly uneven distributions depending on the generator's internal representation and the rounding method. A proper integer-in-range generator uses modular arithmetic or rejection sampling to ensure each value in the range has exactly equal probability.
For normal use cases, modern implementations handle this correctly. The issue appears when implementing custom generators or when precision in distribution is required for statistical analysis.
Conclusion
The distinction between true randomness and pseudorandomness is real and matters in cryptographic contexts. For the vast majority of uses, including giveaways, sampling, simulation, games, and educational exercises, a well-implemented pseudorandom generator with a good seed produces outputs that are random enough for any practical purpose.
ToolHQ's random number generator produces integers in any range you specify, using the browser's built-in pseudorandom implementation with a seed derived from current time and system state.
Frequently Asked Questions
Are computer-generated random numbers truly random?
No. Most are pseudorandom: generated by deterministic algorithms that produce sequences which appear random but are reproducible given the same seed. Hardware random number generators, seeded by physical entropy sources, produce genuine randomness.
What is the difference between random and pseudorandom numbers?
Truly random numbers are unpredictable because they derive from genuinely random physical processes. Pseudorandom numbers are produced by algorithms that are deterministic but have long periods and good statistical properties.
Does it matter for a raffle whether numbers are truly random?
No. Pseudorandom numbers are statistically uniform and unpredictable in practice. For purposes like raffles, games, or sampling, pseudorandom is functionally equivalent to truly random.