Where the randomness comes from
This generator uses crypto.getRandomValues(), the browser's cryptographically secure random number generator. It draws entropy from the operating system — timing jitter, hardware noise, and on modern CPUs a dedicated instruction — and is the same source used to generate encryption keys.
The common alternative, Math.random(), is a pseudo-random generator seeded predictably. Its output is statistically reasonable but reconstructible by an attacker who observes enough of it. For anything where fairness matters — a prize draw, a randomised assignment — the cryptographic source is the right one.
Draw until value < limit, then return value mod range
Common uses
| Task | Setting |
|---|---|
| Roll a die | 1 to 6, one number |
| Flip a coin | 0 to 1, one number |
| Lottery draw | 1 to 49, six numbers, no duplicates |
| Pick a winner from a list | 1 to n, one number |
| Randomise an order | 1 to n, n numbers, no duplicates, unsorted |
| Assign to groups | 1 to number of groups, n numbers, duplicates allowed |
| Sample from a dataset | 1 to n, sample size, no duplicates |
With or without duplicates
With duplicates is sampling with replacement — each draw is independent, and rolling a six does not make the next six less likely. This is what dice and coins do.
Without duplicates is sampling without replacement, which is what a lottery or a shuffled deck does. Each draw removes that number from the pool, so the odds shift as you go. The count cannot exceed the range size.
Two things randomness is not
The gambler's fallacy
After five heads in a row, the next flip is still exactly 50/50. The coin has no memory. The belief that a run "must" end is the gambler's fallacy, and it costs people real money.
What is true is that long runs are rare in advance. The probability of five heads is 1 in 32 before you start. Once four have landed, the fifth is still 1 in 2.
Random does not look random
True randomness produces clusters and streaks that feel wrong. In 100 coin flips, a run of six or more identical results is more likely than not. People asked to write down a "random" sequence produce far fewer runs than genuine randomness does, which is precisely how fabricated data is detected.
Frequently asked questions
Are these numbers truly random?
They come from crypto.getRandomValues(), which draws on operating-system entropy including hardware sources. This is cryptographically secure randomness, not a predictable pseudo-random sequence.
Rejection sampling ensures every number in your range is exactly equally likely, with no modulo bias.
What does "no duplicates" do?
It samples without replacement, like a lottery draw — each number can appear only once. The number of results cannot exceed the size of the range.
Leaving it unticked samples with replacement, which is how dice and coins behave.
Can I use this for a prize draw?
For an informal one, yes — the randomness is sound. Number your entrants, generate one number, and that is your winner.
For a regulated draw with legal requirements, use a certified system with an audit trail.
Why do I sometimes get the same number twice?
Because with duplicates allowed, each draw is independent. Getting 42 twice in a row from 1 to 100 has a 1 in 100 chance and is entirely normal.
Tick "no duplicates" if you need each value to appear at most once.