Random Number Generator

Five numbers between 1 and 100

With a seed of 42, a range of 1 to 100 and duplicates allowed, this generator produces 61, 45, 86, 67, 18.

Run it again with the same seed and you get exactly the same five numbers. That is deliberate, and it is the most important thing to understand about this tool: it is pseudorandom, not random.

Pseudorandom versus truly random

A pseudorandom number generator is a deterministic algorithm. Given a starting value — the seed — it produces a sequence that passes statistical tests for randomness but is entirely reproducible. Same seed, same sequence, every time, on every machine.

True randomness comes from a physical process: atmospheric noise, radioactive decay, thermal noise in a circuit. It cannot be reproduced and cannot be predicted even with complete knowledge of the algorithm, because there is no algorithm.

Reproducibility is a feature in many contexts and a fatal flaw in others.

When a seed is what you want

Reproducible research and simulations — a colleague can run your analysis and get identical results, which is what makes the work verifiable.

Testing and debugging — a test that fails on random input is very hard to fix; a test that fails on seed 42 can be run repeatedly until understood.

Fair and auditable draws — publishing the seed and algorithm in advance lets participants verify afterwards that a draw was not manipulated.

Games — procedurally generated worlds that can be shared by passing around a seed.

When it absolutely is not

Never use a seeded or general-purpose pseudorandom generator for anything security-related. Passwords, encryption keys, session tokens, API secrets, OTPs and password-reset links all require a cryptographically secure random source.

The reason is that standard generators are predictable. Given a few outputs, an attacker can often determine the internal state and compute every subsequent value. Several real breaches have traced to exactly this — session tokens generated by a predictable function, allowing accounts to be taken over without any password being guessed.

Cryptographically secure generators (`crypto.getRandomValues` in browsers, `secrets` in Python, `/dev/urandom` on Unix) draw from the operating system's entropy pool and are designed so that observing outputs reveals nothing about future ones.

Duplicates, and which setting you want

Allowing duplicates means each draw is independent — like rolling a die repeatedly. Drawing 5 numbers from 1–100 with duplicates allowed can legitimately produce the same number twice.

Disallowing duplicates samples without replacement, like drawing names from a hat. This is what you want for lottery-style selections, assigning unique identifiers, or picking a shortlist.

Note that disallowing duplicates requires the range to be at least as large as the count — asking for 10 unique numbers between 1 and 5 is impossible.

Reading the result

The distribution is uniform — every value in the range is equally likely. That has a consequence people find counter-intuitive: genuinely uniform output produces clusters and apparent patterns far more often than intuition expects. Three numbers close together in a draw of five is unremarkable, not evidence of a fault.

The related error is the gambler's fallacy — believing that a number which has not appeared recently is somehow due. Each draw is independent, and the generator has no memory of what it produced before.

Common mistakes

Using it for passwords or tokens. Use a cryptographic generator instead.

Expecting no repeats with duplicates allowed. Repeats are normal and expected.

Reading patterns into uniform output. Clustering is what randomness actually looks like.

Reusing a seed unintentionally. If you want different results, change or omit the seed.

Assuming a shuffled list is uniformly shuffled. Naive shuffling algorithms are biased; use Fisher-Yates.