Random Numbers in Software Are Not Random

Math.random is not random. It is a deterministic algorithm that produces numbers that look random but are entirely predictable if you know the seed. For most applications this is fine. For security it is catastrophic. Pseudorandom vs. cryptographically secure Math.random() uses a pseudorandom number generator (PRNG). It is fast and produces a uniform distribution, but the sequence is deterministic. Given the same seed, it produces the same sequence every time. // Pseudorandom - fine for games, simulations, UI Math . random (); // 0.0 to 1.0 // Cryptographically secure - required for security crypto . getRandomValues ( new Uint32Array ( 1 ))[ 0 ]; crypto.getRandomValues() uses the operating system's cryptographic random source (like /dev/urandom on Linux). It is slower but unpredictable, making it suitable for generating passwords, tokens, and encryption keys. Generating random integers in a range The naive approach has a subtle bias: // Biased - do not use for anything important Math .