How Computers Generate Random Numbers
Computers are deterministic machines — give them the same input, they produce the same output, every time. So where does "randomness" actually come from in a system built to be predictable?
Pseudo-random vs truly random
Most software randomness is pseudo-random: generated by a deterministic algorithm seeded with some starting value, producing a sequence that looks statistically random but is technically reproducible if you know the seed. This is fine for games, simulations, and shuffling a playlist — nobody needs unpredictability strong enough to resist a determined attacker.
Where "good enough" randomness isn't good enough
Security-sensitive uses — generating a password, a session token, a cryptographic key — need randomness that's unpredictable even to someone who understands the algorithm generating it. This is why JavaScript provides two different tools: Math.random() for general use, and crypto.getRandomValues() for anything security-related, drawing from the operating system's cryptographically secure random source.
A practical comparison
| Math.random() | crypto.getRandomValues() | |
|---|---|---|
| Speed | Fast | Slightly slower, still fast enough for interactive use |
| Predictability | Can be predicted if internal state is known | Not practically predictable |
| Appropriate for | Games, animations, non-security randomness | Passwords, tokens, anything security-related |
Why this distinction is easy to miss
Both functions return numbers that look equally random to a casual glance — the difference only shows up under adversarial analysis, which is exactly why using the wrong one is a subtle, easy-to-overlook security mistake rather than an obvious bug.
Frequently asked questions
No — it's not designed to resist prediction, and should never be used for passwords, tokens, or anything security-sensitive. Use a cryptographically secure random source instead.
A seed is the starting value that determines a pseudo-random sequence — using the same seed always reproduces the same sequence, which is useful for testing but means the sequence isn't truly unpredictable.