How Random Number Generators Actually Work (And Why It Matters for Passwords)

"Random" on a computer almost always means pseudo-random — generated by a deterministic algorithm that produces output statistically indistinguishable from true randomness, but not actually random in the physical sense. The important distinction isn't whether it's pseudo-random (nearly everything is), it's whether it's predictable to an attacker.

Math.random() is not built for security

JavaScript's Math.random() uses a fast pseudo-random number generator (PRNG) designed for speed and general use — animations, shuffling a list, picking a random example. Its output can, in principle, be predicted if an attacker knows or can guess its internal state, because it's optimized for performance, not unpredictability. That's completely fine for a game or a UI animation and completely unsafe for anything security-sensitive, like generating a password or a session token.

crypto.getRandomValues() is built for exactly that

The Web Crypto API's crypto.getRandomValues() pulls from a cryptographically secure random source — on most systems, ultimately sourced from real-world entropy the operating system collects (hardware noise, timing jitter, and similar). It's specifically designed so that past output gives an attacker no usable information about future output, which is the actual property you need for passwords, tokens and encryption keys.

Why this matters for a password generator specifically

What this means for you as a user

• For picking a random number for a game, giveaway or non-sensitive decision — any random generator is fine.
• For generating a password, API key, or anything security-relevant — use a tool that's explicitly built on a cryptographically secure random source, not a generic "random number" utility.
• You generally can't tell which one a tool uses just by looking at the output — check that the tool states it uses a cryptographically secure method, since predictable-looking randomness and genuinely unpredictable randomness look identical to the eye.