Random number generator
Pick fair numbers for raffles, games, sampling or decisions: using your browser's cryptographic randomness, not a predictable formula.
Most "random" functions follow a formula that can be predicted. This tool uses the same source of randomness browsers use for encryption keys.
A fair die lands on each face about equally often, but never perfectly evenly in small runs. Run the test and watch the bars settle as the rolls add up.
Computers are predictable machines, so producing unpredictable numbers takes care. There are three common approaches.
Math.random()A formula that produces a long, random-looking sequence from a starting seed. Fast, but if someone learns the seed they can predict every number.Good for:games, animations, simulations.crypto.getRandomValues()The operating system mixes unpredictable events, hardware timing, input, sensor noise, into a secure generator. It can’t be predicted from past output.Good for:draws, winners, passwords and keys.dice · atomic noiseMeasures a physical process such as radioactive decay or atmospheric noise. Truly unpredictable, but needs special hardware.Good for:official lotteries and scientific research.number · 1-250 · ×1Use these settingsnorth_eastnumber · 1-500 · ×3 · no repeatsUse these settingsnorth_eastnumber · 1-1000 · ×20 · sortedUse these settingsnorth_eastnumber · 1-12 · ×6 · sortedUse these settingsnorth_eastdice · ×2Use these settingsnorth_eastcoin · ×1Use these settingsnorth_eastA pseudo-random generator is a formula applied to a hidden state. If its outputs reveal enough of that state, an observer can rebuild it and predict every later number. The attack below runs live in your browser against Java’s java.util.Random. The panel beside it shows a second kind of failure: outputs that look random one at a time but follow a pattern together.
s = (s × 0x5DEECE66D + 0xB) mod 2⁴⁸. Each nextInt() returns the top 32 bits of s, so one output leaves only 16 bits unknown. The attack tries all 65,536 possibilities and keeps those that also produce the second output.Math.random() uses xorshift128+ rather than an LCG, but it is not safer for this purpose: published attacks rebuild its 128-bit state from a few consecutive outputs with an SMT solver. crypto.getRandomValues() is designed so that no number of outputs reveals its state.Shuffling a list is the usual next step after picking random numbers: drawing an order of play, assigning seats, randomising a survey. Three common methods are run below on the same list, many times each, and every possible order is counted. Only one of them makes every order equally likely.
for i from n−1 down to 1: j = random(0..i) swap a[i], a[j]for i from 0 to n−1: j = random(0..n−1) swap a[i], a[j]a.sort(() => Math.random() − 0.5)Drawing k numbers from a range of n with repeats allowed, the chance that two match grows with k², not k. This is the birthday problem: 23 people give better-than-even odds of a shared birthday. The exact probability is computed below, then checked by actually drawing with your browser’s secure generator.
P(no repeat) = (n−1)/n × (n−2)/n × … × (n−k+1)/n ≈ e^(−k(k−1) / 2n)Period is how long a generator runs before repeating; state is how much hidden memory it has. Neither makes a generator secure. That depends on whether outputs reveal the state.
crypto.getRandomValues(new Uint8Array(65536))Maximum 65,536 bytes per call.ok, 65,536 bytescrypto.getRandomValues(new Uint8Array(65537))One byte over the limit throws QuotaExceededError.throws QuotaExceededErrorcrypto.getRandomValues(new Float64Array(4))Integer typed arrays only. Floats throw TypeMismatchError.throws TypeMismatchErrorcrypto.randomUUID()Version 4 UUID from the same source. Secure contexts only.519430cf-a48b-494f-94a6-d9606c38fe91window.isSecureContextrandomUUID and crypto.subtle need HTTPS or localhost; getRandomValues does not.trueMath.random() step sizeThe spec asks only for approximately uniform values in [0, 1). Engines choose the resolution.2^−53 (53 random bits)Same secure randomness, shaped for different jobs.