FlowingDev

Randomness, explained: how your computer fakes a coin flip

Understand how computers generate pseudo-random numbers (PRNGs) and why true, unpredictable randomness is so surprisingly hard for a deterministic machine.

Try the tool: Random Generator

In one sentence

Random generation is a computer's best attempt at producing unpredictable sequences of numbers or characters, a task that's fundamentally at odds with its deterministic nature.

The problem it solves

Humans have needed randomness for millennia. We've rolled dice made of knuckle-bones, shuffled cards, and drawn lots to make decisions, play games, and ensure fairness. When computers arrived, we wanted them to do the same things: shuffle a digital deck of cards, create unpredictable enemies in a game, or generate a secure, one-time password.

But there's a huge philosophical pickle here. A computer is a hyper-obedient, logic-driven machine. It does exactly what it's told, every single time. If you give it the same inputs and the same instructions, you will get the exact same output. It's the definition of predictable. So how can you get something unpredictable from a machine that's the literal poster child for predictability?

Early computer scientists wrestled with this. The legendary John von Neumann came up with an early method in the 1940s called the "middle-square method." You'd take a number (say, 4 digits), square it, and then take the middle 4 digits of the result as your next "random" number. Then you'd repeat the process. It was clever, but it had a nasty habit of quickly falling into short, repeating loops or degrading to zero, at which point it stays zero forever. Oops.

This core conflict—the need for unpredictability from a predictable machine—led to the creation of a whole field of study dedicated to faking it 'til you make it. The solution isn't to make the computer truly random, but to make it so mind-bogglingly complex in its calculations that the results are, for all practical purposes, indistinguishable from random.

How it works under the hood

To peek behind the curtain of digital randomness, you need to understand two key concepts: the "seed" and the "algorithm." Together, they form what's called a Pseudo-Random Number Generator, or PRNG. The "pseudo" is key—it's a quiet admission that this is all a clever illusion.

The Seed: The Secret Starting Point

Every PRNG needs a starting number, called a seed. Think of it like the unique starting configuration for a deck of cards before you begin shuffling. The entire, infinitely long sequence of numbers the generator will produce is pre-determined by this single seed value.

  • If you give two identical PRNGs the same seed, they will produce the exact same sequence of "random" numbers.
  • If you give them different seeds, they will produce different sequences.

This is both the PRNG's greatest weakness and its greatest strength. For a video game, using the same seed to generate a universe means players can share that seed and explore the identical "randomly" generated world. For a security system, an attacker who can guess your seed can reproduce your "random" secret key. This is why choosing a good, unpredictable seed is critically important. A common but weak method is to use the current time in milliseconds. A much stronger method involves gathering unpredictable data from the system, like mouse movements, keyboard timings, and network packet arrivals.

The Algorithm: The Magic Number Machine

Once you have a seed, the algorithm takes over. It's a mathematical function that takes one number, performs a series of operations on it, and spits out the next number in the sequence. The new number is then used as the input for the next round.

A classic, simple example is the Linear Congruential Generator (LCG). Its formula looks like this:

X_next = (a * X_current + c) % m

Let's break that down:

  • X_current is the number we have now (starting with the seed).
  • a (the multiplier), c (the increment), and m (the modulus) are pre-chosen magic numbers that define the generator's properties.
  • The % is the modulo operator—it gives you the remainder of a division. This is what keeps the numbers within a specific range (from 0 to m-1).

Imagine a=7, c=3, m=10, and our seed X_current=5.

  1. Round 1: (7 * 5 + 3) % 10 -> 38 % 10 -> 8. Our first random number is 8.
  2. Round 2: (7 * 8 + 3) % 10 -> 59 % 10 -> 9. Our second random number is 9.
  3. Round 3: (7 * 9 + 3) % 10 -> 66 % 10 -> 6. And so on...

Modern systems use far more sophisticated algorithms, like the Mersenne Twister, which has a ridiculously long period (the number of iterations before the sequence repeats) and better statistical properties. But the core principle is the same: take a number, scramble it mathematically, get a new number.

True Randomness vs. Pseudo-Randomness

So, if all of this is "pseudo," does "true" randomness exist in computers? Yes, but it's a different beast entirely. It's generated by a True Random Number Generator (TRNG), also called a Hardware Random Number Generator (HRNG).

Instead of a deterministic algorithm, a TRNG taps into unpredictable physical phenomena. Think of it as a computer listening to the universe's static. Sources can include:

  • Atmospheric noise from radio receivers.
  • The thermal noise of a semiconductor.
  • The exact timing of radioactive decay.
  • Quantum phenomena.

Cloudflare famously uses a wall of lava lamps, pointing a camera at them and using the unpredictable, chaotic swirling of the wax to generate random data. This is true, unpredictable entropy.

Here’s a quick comparison:

Feature PRNG (Pseudo-Random) TRNG (True Random)
Source Deterministic algorithm Unpredictable physical process
Seed Requires a seed; same seed = same output Doesn't use a seed; output is non-deterministic
Speed Very fast Relatively slow; limited by the physical process
Reproducibility Yes, by design No, by design
Typical Use Simulations, games, testing, mock data High-stakes cryptography (e.g., generating master keys)
Browser JS Example Math.random() window.crypto.getRandomValues() (CSPRNG)

Note: window.crypto.getRandomValues() is technically a Cryptographically Secure PRNG (CSPRNG). It's an algorithm, but it's seeded with true entropy from the operating system, designed to be unpredictable even if an attacker knows part of its state. It's the best of both worlds for most security needs.

Real-world stories

The Case of the Predictable Video Poker Machine

In the 1990s, the Nevada Gaming Commission was stumped. A man was winning an unusual number of video poker jackpots. After an investigation, they discovered he wasn't cheating in the traditional sense. He had bought an identical machine, taken it home, and reverse-engineered its software. The machine used a simple PRNG that was re-seeded with a predictable value every time it was turned on. By playing his home machine, he learned the patterns. He could turn on the casino's machine, play a specific sequence of hands, and know exactly when the royal flush was coming.

The lesson: The quality of your randomness is directly proportional to the stakes. For trivial tasks, any PRNG will do. When money or security is on the line, a simple, predictable generator is a massive vulnerability.

The Minecraft World Seed

Anyone who has played Minecraft knows the magic of the "world seed." When you create a new world, the game can generate a random seed for you, or you can input one yourself. This seed is fed into a sophisticated PRNG that procedurally generates a vast, unique landscape of mountains, caves, and oceans. The beauty is that this process is entirely deterministic. If you share the seed "1379963879" with a friend, they will spawn in the exact same world you did, able to find the same village at the same coordinates.

The lesson: Reproducible randomness is an incredibly powerful feature, not a bug. It's essential for simulations, procedural generation, and any scenario where you need to re-create a complex "random" state perfectly.

The Lottery Ticket Debacle

An information security director for a multi-state lottery association rigged the system to win millions. How? He gained access to the lottery's secure room and installed a tiny bit of code on their random number generator. His code was simple: if the lottery drawing happened on certain days of the year, the generator would use a predictable algorithm with a known seed. He could then buy tickets with the handful of combinations he knew would be chosen, guaranteeing a win. He was eventually caught, but the attack highlighted a fundamental truth.

The lesson: The most secure random number generator in the world is useless if the process around it is compromised. Protecting the seed and the integrity of the generation process is as important as the algorithm itself.

Common mistakes and traps

  • Using Math.random() for security. In JavaScript, Math.random() is the go-to for quick-and-dirty randomness. But it is not cryptographically secure. Its implementation is up to the browser, it may be seeded insecurely, and its output can potentially be predicted by an attacker. For anything security-related—session tokens, password resets, crypto keys—you must use window.crypto.getRandomValues().
  • Seeding with only the current time. A classic mistake. If an attacker knows roughly when you generated a "random" secret (e.g., they know a user signed up within a specific 10-minute window), they can massively reduce the number of seeds they have to guess. They can just try every millisecond in that window, reproduce all the possible "random" numbers, and find your secret.
  • Expecting uniform distribution in small samples. If you ask for ten random numbers between 1 and 10, you are not guaranteed to get each number once. You might get three 7s and no 2s. This is normal. True randomness includes clusters and streaks. Don't assume your generator is "broken" just because the output doesn't look random to your pattern-seeking human brain.
  • Rolling your own random generator. Unless you are a Ph.D. in mathematics and cryptography doing it for academic purposes, never, ever write your own PRNG for a real application. Use the battle-tested, peer-reviewed generators built into your language's standard library or crypto modules. They've been vetted for subtle flaws you will almost certainly miss.

Why it belongs on your radar

As a developer, you'll reach for a random generator constantly. It's not a niche tool; it's a fundamental building block for modern software.

You should think about randomness whenever you're:

  • Creating unique identifiers: Generating temporary passwords, password reset tokens, session IDs, API keys, or UUIDs.
  • Running tests or simulations: Creating mock data with random values, fuzz testing an API endpoint by throwing random inputs at it, or simulating user behavior.
  • Building games: Shuffling a deck of cards, determining loot drops, rolling dice for damage, or generating a procedural map.
  • Implementing security features: Generating salts for password hashing, creating keys for encryption, or producing nonces for cryptographic protocols.
  • Adding a bit of flair: Choosing a random background color, displaying a "quote of the day," or A/B testing different button styles.

Understanding the difference between a standard PRNG and a CSPRNG is crucial for writing secure, reliable code.

Go deeper

Theory done. Time to get your hands dirty — 100% in your browser.

Try the tool: Random Generator