How Random Number Generators Work

Shuffled playlists, game loot, encryption keys and online draws all depend on random numbers. Computers produce them in two very different ways.

Why computers struggle with randomness

A computer is built to be predictable: the same input and the same program should always give the same output. That is exactly what you want from a calculator and exactly what you do not want from a dice roll. Random number generation is the process of producing a sequence of numbers that cannot be reasonably predicted better than by chance, and engineers have two main ways to do it.

Pseudorandom generators

A pseudorandom number generator (PRNG) is an algorithm that produces a long sequence of numbers whose properties approximate randomness. It starts from an initial value called a seed. Given the same seed, it produces the same sequence every time. That sounds like a flaw, but it is useful: a game developer can reproduce a bug, and a scientist can rerun a simulation exactly.

A well-known example is the Mersenne Twister, a general-purpose PRNG used as the default in many programming languages. It is fast and statistically good for simulations, but it is not designed to resist someone trying to predict its output, so it is not suitable for security.

Hardware generators

A hardware random number generator measures a physical process that is unpredictable, such as electrical noise in a circuit, and turns it into numbers. Many modern processors include one. Hardware sources are often used to seed a PRNG, combining the unpredictability of physics with the speed of an algorithm.

Cryptographically secure generators

For passwords, encryption keys and anything an attacker might want to guess, systems use a cryptographically secure PRNG. These are designed so that seeing part of the output does not help predict the rest. Operating systems provide one; programmers should use it rather than a general-purpose generator for anything security-related.

How randomness is tested

You cannot prove a sequence is random by looking at a few numbers. Instead, testers run large batteries of statistical checks: are all values equally common, do patterns repeat, do numbers depend on the ones before them? Passing these tests does not guarantee unpredictability, but failing them is a clear warning. Services that rely on random outcomes often have their generators reviewed by independent testers.

What this means for you

• A "random" shuffle that feels streaky is usually still random. True randomness produces clusters more often than people expect.
• Some music apps deliberately make shuffle less random so it feels fairer to listeners.
• For passwords, use your device's built-in password generator, which draws on a secure source.
• When money depends on a random outcome, look for who runs the generator and whether it is independently checked.

Written by Selim Arda · rev. 2026-11-09