gg
Home › Blog › What “random” actually means on a computer

What “random” actually means on a computer

2026-08-28 · 4 min read
mathsecurityabout

Ask a computer for a random number and it does not reach for anything unpredictable. It runs a short piece of arithmetic on a number it is already holding, hands you the result, and keeps the new number for next time. The whole sequence was decided the moment that starting number — the seed — was set.

The mechanism, in full

The generator behind every generator tool on this site is a SplitMix64. It holds one 64-bit value. Each time you ask for a number it adds a fixed odd constant to that value, then puts the result through a fixed scrambling step of shifts, exclusive-ors and multiplications. That is the entire algorithm. There is no clock reading, no mouse movement, no measurement of anything physical.

Two consequences follow immediately, and they are the same fact seen from two sides.

Same seed, same numbers. Feed the generator the seed 12345 on a laptop today and on a server next year and both produce an identical stream. This is not a defect anybody is working on. It is what makes a "random" tool testable at all: the test suite for this site pins a seed and asserts on exact output, which is only possible because the output is a function of the seed. It is also what lets a draw be re-run by somebody who was not in the room — the site's Reproducible Fair Draw tool is built on precisely this property, and publishes the seed so anybody can replay the result.

Same seed, same numbers. Read the other way: an observer who learns the state can compute every number you are about to get. And the scrambling step is invertible — it is a one-to-one map on 64-bit values, built from operations that each have an exact inverse. Anybody who knows the algorithm and sees one output can work backwards to the state that produced it. Nothing about a PRNG is designed to stop that, because resisting that is not what a PRNG is for.

PRNG and cryptographic source

A pseudo-random generator has one goal: produce numbers whose statistical shape looks like the real thing — flat across the range, no visible pattern, no short repeats. It is judged on how it looks to a statistician.

A cryptographic random source has a second goal on top: an observer who has seen a great deal of the output should still be unable to work out what comes next, or what came before. It is judged on how it looks to an adversary. Operating systems provide one of these, drawing on genuinely unpredictable measurements the machine collects, and a browser exposes it as crypto.getRandomValues.

The two are not weak and strong versions of one thing. They answer different questions, and the second answer costs more to produce.

Which one this is, exactly

This site's tools use the first kind, with one honest detail worth stating. Every time you press Generate, the page draws a fresh 64-bit seed from the browser's cryptographic source and hands it to the PRNG. So the starting point is unpredictable; the stream that follows it is not.

That places a hard ceiling on the result. A 64-bit seed has 2^64 possible values — 18,446,744,073,709,551,616 of them — and the output is a function of the seed, so there are at most that many distinct results a click can produce, however long the printed answer is. For picking a number between 1 and 100 the ceiling is irrelevant. For anything protecting real value it is the number that matters.

So what is it safe for

Good uses: picking a number, a name or an order for something that does not need to resist a determined opponent. Test fixtures, sample data, a starting player, a shuffle at a games night, a colour to try out.

Not safe for anything protecting real value. That means encryption keys, session tokens, password-reset links, API secrets you will rely on, or any draw where money changes hands. These tools are not cryptographically secure and are not offered as if they were. If you need a secret, use a purpose-built source: your platform's secure random function, a password manager, or a key-generation library.

For passwords specifically, this site has a Password Generator and a Passphrase generator, which is where that job belongs — they pick from sensible alphabets, refuse look-alike glyphs, and print the actual strength arithmetic instead of a colour-coded bar. Note the same 64-bit ceiling applies to them, because they run on the same generator from the same per-click seed.

The tool

The Random Number generator returns one integer between the bounds you give, inclusive at both ends, swapping them if you type the larger one first. It runs on your device and uploads nothing. Treat the result as a fair pick and not as a secret, and you are using it for exactly what it is.

Try it free — with the steps shown

The Random Number runs in your browser and shows exactly how it got the answer, so the method sticks.

Open Random Number

More from the blog