Randomness Explained: From Coin Flips to Secure Generators

Randomness is everywhere: a dice roll in a board game, a coin flip to settle a bet, a random password, a shuffled playlist. But what does “random” actually mean, and is a button-press result the same kind of randomness that protects your passwords?

This guide explains the two kinds of randomness most people encounter, why a simple shuffle isn’t always enough, and when a quick generator is perfectly fine.

Two kinds of randomness

The word “random” covers two different things:

Statistical randomness — the result is unpredictable and uniformly distributed, but it doesn’t need to be secure. A dice roll is a good example: you can’t guess it, but you also wouldn’t use it to generate a bank password.
Cryptographic randomness — unpredictable and secure against an attacker trying to guess it. This is what you want for passwords, tokens, and keys. It draws entropy from sources like operating-system entropy or a hardware random number generator.

The distinction matters because the two are not interchangeable. A regular Math.random() call in a language is fine for games and decisions, but it’s not suitable for anything security-sensitive.

How a random number generator works

A generator that produces numbers you can’t predict works roughly like this:

Seed. It starts from a seed — a number that determines the whole sequence.
Algorithm. It runs a deterministic algorithm on the seed to produce a sequence of numbers.
Period. Because it’s deterministic, the sequence eventually repeats. For normal use the period is so long that it doesn’t matter.

These are called pseudo-random number generators: they’re deterministic and reproducible if you know the seed, but the sequence looks random. That’s fine for most uses.

Cryptographically secure generators go further. They aren’t seeded the same way — they incorporate real-world entropy, so even if an attacker knows the algorithm, they can’t predict the output. That’s why a password generator uses crypto.getRandomValues() rather than a plain shuffle.

When a simple generator is enough

For most everyday uses, a simple random generator is perfectly adequate:

Deciding between options — which restaurant, who goes first, what to watch.
Rolling dice for a game.
Drawing a name from a list.
Shuffling a playlist or a deck.

None of these need to be secure; they just need to feel fair and unpredictable.

When you need real security

If the result is going to protect something, you need cryptographic randomness:

Passwords and passphrases — a random-but-not-secure generator is a liability.
Tokens and API keys — these are meant to be unguessable.
Session IDs and encryption keys — the whole point is that nobody can predict them.

The key distinction: if a “random” value is a secret that an attacker could guess, it needs to come from a cryptographically secure source. If it’s just for fun or a fair decision, a simple generator is fine. Choosing and protecting the passwords those secure generators produce is its own subject — see the password security guide.

Quick Reference

Two kinds of randomness: statistical (unpredictable but not secure — dice) and cryptographic (secure against guessing — passwords, tokens, keys).
They are not interchangeable: a plain Math.random() is fine for games and decisions, wrong for anything security-sensitive.
Pseudo-random generators are seeded, deterministic, and eventually repeat; cryptographically secure generators mix in real entropy so output can’t be predicted.
A simple generator is fine for restaurant choices, dice, draws, and shuffles — nothing needs protecting.
If a “random” value is a secret an attacker could guess, it must come from a cryptographically secure source.

Getting started

If you need a number, a coin flip, or a choice from a list, the Random Number Generator gives you a range of random numbers, and if you want to settle an indecision, the Random Decision Maker flips a coin, rolls dice, or picks from your own options — all in the browser. For genuine security, use the Password Generator, which draws from a cryptographically secure source.