Random Number Generator

Why computers struggle to be random

A computer is a deterministic machine — given the same inputs it produces the same outputs, every time, which is precisely the property that makes it useful and precisely the property that makes randomness hard. Software random number generators are therefore pseudorandom: they run a deterministic algorithm from a starting seed, producing a sequence that passes statistical tests for randomness but is entirely reproducible if you know the seed. To get real unpredictability, the seed must come from somewhere genuinely unpredictable, so operating systems harvest entropy from the physical world — the precise timing of keystrokes and disk operations, thermal noise in the hardware, mouse movements. Cryptographic generators are seeded from that pool, which is what makes their output unguessable in practice.

The randomness you should not use

Most programming languages ship two random number generators, and the difference between them has caused real security failures. The ordinary one — Math.random in JavaScript, rand in C — is fast, statistically decent and completely unsuitable for anything secret, because observing enough of its output lets you reconstruct its internal state and predict every future value it will produce. Online casinos, lottery systems and session token generators have all been broken exactly this way. The cryptographic one is slower and unpredictable even to an attacker who has seen unlimited prior output. The rule is simple: if the number needs to be unguessable by an adversary, use the cryptographic source. If it is for a simulation or a game animation, the fast one is fine.