Secure Random Number Generator

CSPRNG vs PRNG: The Mathematics of Computer Randomness

Generating genuine randomness in deterministic digital computers is one of the most challenging problems in computer science. Traditional pseudo-random number generators (PRNGs), such as the algorithms behind Math.random() in JavaScript or random.random() in Python, are completely deterministic mathematical formulas initialized by a seed value.

For scientific simulations, lottery draws, cryptographic key derivation, and statistical sampling, standard PRNGs are dangerous because an observer can predict future outputs after analyzing a small sequence of numbers. Cryptographically Secure Pseudo-Random Number Generators (CSPRNG) solve this by harvesting entropy from unpredictable physical hardware events (thermal sensor noise, atmospheric radio noise, disk I/O timings, and mouse movement jitter).

Our Random Number Generator harnesses the browser's native CSPRNG (crypto.getRandomValues) to generate statistically unbiased integer and decimal values within customizable min/max ranges.

Eliminating Modulo Bias in Random Range Selection

A subtle mathematical defect in naive random number generators is modulo bias. When mapping a 32-bit random integer (range 0 to 4,294,967,295) into a smaller range (like 1 to 10) using simple modulo arithmetic (rand % 10), numbers at the lower end of the range have a slightly higher probability of selection because 2^32 is not evenly divisible by 10.

Our algorithm implements rejection sampling (the Fisher-Yates approach), discarding values in the truncated remainder window to ensure mathematically perfect uniform distribution across all possible outcomes.

Programmatic CSPRNG Random Integers in JavaScript & Python

// Unbiased CSPRNG Random Integer between min and max (inclusive)
function secureRandomInt(min, max) {
  const range = max - min + 1;
  const maxSafe = Math.floor(0xFFFFFFFF / range) * range;
  const uint32 = new Uint32Array(1);

  let rand;
  do {
    window.crypto.getRandomValues(uint32);
    rand = uint32[0];
  } while (rand >= maxSafe); // Rejection sampling eliminates modulo bias

  return min + (rand % range);
}

console.log(secureRandomInt(1, 100));

# Python 3 secrets module
import secrets

# Generates unbiased random integer in range [min, max]
secure_int = secrets.randbelow(100) + 1 # 1 to 100
print("Random Int:", secure_int)

Bulk Sampling with or without Replacement

Our generator allows bulk output generation (up to 1,000 numbers at once) with options for with replacement (numbers can repeat, like rolling dice) or without replacement (unique numbers only, like drawing lottery balls or shuffling cards).

CSPRNG Hardware Entropy Harvesting vs PRNG Predictability

Software pseudo-random number generators (PRNGs) like JavaScript's native Math.random() rely on deterministic linear recurrence algorithms, historically xoshiro128+ or XorShift128+. Given an observed sequence of output floats, an external adversary can mathematically reconstruct the internal generator state and predict every subsequent number with 100% certainty, rendering PRNGs catastrophically unsafe for tokens, lotteries, or cryptographic keys.

In contrast, Cryptographically Secure Pseudo-Random Number Generators (CSPRNG) utilize operating system entropy pools harvested from unpredictable hardware events (thermal sensor noise, interrupt timing variations, disk I/O latency). The browser's crypto.getRandomValues() interface maps directly to kernel primitives (such as Linux /dev/urandom or macOS getentropy()) to guarantee unbiasable, uniform distributions passing all Dieharder and NIST SP 800-22 statistical test suites.

Frequently Asked Questions