If you're generating passwords, tokens, or encryption keys using Math.random() in JavaScript — stop. It's not truly random, and it's not safe for security-sensitive use cases.
PRNG vs CSPRNG
Pseudorandom Number Generators (PRNG) — functions like Math.random() use a mathematical algorithm seeded from an initial value. They are fast but not suitable for cryptography.
Cryptographically Secure PRNGs (CSPRNG) — use hardware entropy sources that are practically impossible to predict. Examples: crypto.getRandomValues() in JavaScript, the secrets module in Python 3, and /dev/urandom on Linux.
Where the Entropy Actually Comes From
Cryptographically secure generators don't pull randomness out of thin air — they harvest genuine physical unpredictability from the operating system: timing jitter between hardware interrupts, mouse movement, disk I/O timing, and dedicated hardware random number generators on modern CPUs. The OS pools this "entropy" and uses it to seed the CSPRNG, which is why crypto.getRandomValues() and /dev/urandom are considered secure — they're ultimately rooted in physical randomness, not a predictable formula.
Why This Actually Matters: A Concrete Example
Math.random() in most JavaScript engines is seeded from a small, predictable internal state. If an attacker can observe even a handful of outputs from the same session — say, several "random" discount codes or session tokens generated in sequence — they can often reconstruct the internal state and predict every future value. This isn't theoretical: this exact class of vulnerability has been used to break password-reset tokens and gambling-site "random" outcomes that relied on standard, non-cryptographic random functions.
When You Need Cryptographic Randomness
- Generating passwords — predictable values can be brute-forced faster
- Creating API keys or tokens — must not be guessable
- Lottery or giveaway picks — fairness depends on unpredictability
- Encryption key generation — entirely depends on entropy quality
When Regular Randomness Is Fine
- Shuffling a playlist or selecting random UI animations
- Simulation, game AI, and statistical sampling
Use the Free Generator
Use the Anonymiz Random Number Generator for secure random numbers without writing code. Supports custom ranges, dice rolling (d4 through d20), lottery sets, coin flips, and cryptographically secure output.
