Pseudo-Random vs True Random Numbers

Two kinds of random

When people say a number is random, they usually mean it is unpredictable. Computing distinguishes two ways of getting such numbers. True random numbers come from physical processes that are hard to predict, such as electronic noise or the timing of hardware events. Pseudo-random numbers come from an algorithm that produces a sequence which only looks random.

The distinction sounds like a flaw in everyday software, but it is a deliberate trade-off. Algorithms are fast, repeatable and easy to run on any device, while physical sources are slower and need special hardware or careful handling.

For most practical purposes the important question is not whether a number is perfectly random in a philosophical sense, but whether anyone can predict it.

How a pseudo-random generator works

A pseudo-random number generator, or PRNG, starts from a value called the seed and applies a fixed procedure to produce a long series of numbers. Its output is completely determined by the seed: start from the same seed and you get the same sequence every time. That is the reason it is called pseudo-random rather than random.

This repeatability is useful. Scientists can rerun a simulation and get identical results, and game developers can reproduce a bug. Good generators also have very long periods before the sequence repeats and their output passes statistical tests for evenness. But ordinary generators are built for speed and statistical quality, not for resisting someone who tries to work out the next value.

Think of a long recipe that always produces the same dish from the same ingredients. If you do not know which ingredients were used, the dish looks unpredictable. If you do know, you can predict every bite.

Where true randomness comes from

Hardware random number generators measure something physically unpredictable and turn it into bits. Operating systems also collect small unpredictable events, often called entropy, from the system and its devices, and use them to feed their random number services.

True randomness has its own practical issues. Raw physical measurements can be biased or correlated and need processing, and the source can fail or degrade without any obvious sign. Because of this, real systems rarely hand the raw physical signal straight to programs. They use it as the seed for a generator.

A browser or operating system hides this complexity. A program simply asks for random values and receives them.

The middle path: cryptographically secure generators

A cryptographically secure pseudo-random number generator, or CSPRNG, combines both ideas. It is an algorithm, but it is seeded with unpredictable data and is designed so that an attacker who sees some of its output cannot work out its future or past output. That property is what makes it suitable for passwords, keys and secure connections.

In browsers, crypto.getRandomValues() provides this kind of source. Documentation from MDN explains that implementations use a pseudo-random generator seeded with a value that has enough entropy, rather than a true random number generator, mainly for performance, and that the result is suitable for cryptographic purposes. In other words, it is the sort of pseudo-random number that is built to be unpredictable.

Does it matter for a giveaway?

For choosing a giveaway winner, the practical answer is that a cryptographically secure generator is more than enough. Nobody can feasibly predict which entry it will place first, so the draw cannot be steered by the host or by an entrant. True hardware randomness would not make the result noticeably fairer.

What matters far more is the quality of the process around the draw: complete lists, clear rules, one draw instead of repeated attempts and honest announcements. A perfect random source cannot rescue a giveaway where invalid entries were left in or where the host kept redrawing.

The same applies to claims about “real” randomness in marketing. A tool that says it uses true randomness is not automatically fairer than one that uses a well-seeded cryptographic generator.

Choosing the wrong generator

Not every pseudo-random source is appropriate for contests with real prizes. General-purpose generators in programming languages are typically fine for games and visual effects, but they are not designed to resist prediction. Documentation for browsers advises using crypto.getRandomValues() where unpredictability matters and a simpler function for casual use.

If a prize has real value, it is sensible to use a tool built on a cryptographic source, so that no one can reasonably claim the outcome could have been anticipated. The extra cost is nothing: the better source is available in every modern browser.

A simple rule helps: if the outcome matters to other people, use the cryptographic source rather than a casual one.

What this means in practice

Some people worry that a pseudo-random result is somehow fake. It is not. Fakeness would mean that the outcome was chosen by someone or that some entries had a better chance. A seeded, well-designed generator does neither: every entry has the same chance, and the order is not known until the draw runs.

If you want to add transparency, show the process rather than debating the source. Announce the closing time, state the number of valid entries, record the draw and explain which method you used. A comment picker such as this one runs in your browser, shuffles the list with the browser’s cryptographic source and uploads nothing, which is a simple and honest description of what happened.