Shuffle a playlist, deal a hand of cards online, encrypt a message or spin a reel, and somewhere underneath a random number generator has just done its job. It is one of the most quietly essential pieces of software on earth, and it rests on a genuine paradox.
Computers are built to be perfectly predictable, producing the same answer from the same instructions every time. Getting a machine like that to hand you a surprise takes a startling amount of mathematics and physics, and following one random number from birth to output shows exactly how.
Asking A Machine For A Surprise
A processor has no imagination whatsoever. Feed it identical inputs and it returns identical outputs, forever, which is exactly the property that makes computers useful and randomness hard.
Engineers solve this in two very different ways. One approach fakes randomness with clever arithmetic, producing what is known as a pseudorandom number, while the other reaches outside the machine to measure something genuinely unpredictable in the physical world.
Almost everything that feels random on a screen leans on one of those two methods, from a card shuffle to a slot reel. Even a free spin claimed with Richard casino promo codes lands on a result chosen by a certified generator rather than by anyone watching the account, which is why regulators care so much about how these systems are built.
Step One – The Seed
A pseudorandom generator is really a machine for stretching a small secret into a long sequence, and that secret is called the seed. It is simply the starting state, the single number the algorithm begins chewing on.
Everything downstream depends on it, because the algorithm itself is completely deterministic. Hand the same generator the same seed twice and you get precisely the same sequence, in the same order.
When The Seed Is Guessable
This is where security lives or dies. Older software often seeded generators with the current clock time, which sounds unpredictable until you realise an attacker who knows roughly when a program started can narrow the possibilities to a few thousand guesses.
A proper seed is drawn from a pool of genuine entropy and is long enough to be hopeless to search, since a 256-bit seed allows more starting states than there are atoms in the observable universe. Scientists sometimes want the opposite, fixing a seed deliberately so a simulation can be repeated exactly.
Step Two – The Algorithm
With a seed in hand, the generator applies a mathematical transformation to its internal state over and over, spitting out a fresh number each time. Different algorithms trade speed, memory and security against each other.
The families you are most likely to encounter look like this:
|
Algorithm |
How it works |
Where you meet it |
|
Linear congruential generator |
Multiplies, adds and takes a remainder to get the next state |
Old textbooks and simple software, now largely retired |
|
Mersenne Twister |
Twists a huge internal state, repeating only after 2^19937 – 1 steps |
The long-standing default in Python, R and Excel |
|
Xorshift and PCG |
Shifts and mixes bits with very little memory |
Modern libraries, including NumPy’s current default |
|
AES-CTR or HMAC DRBG |
Runs a cryptographic cipher or hash to stretch a secret seed |
Encryption keys, secure tokens, anything that must resist attack |
The Mersenne Twister is fast and statistically excellent, yet an observer who collects enough of its output can reconstruct the internal state and predict everything that follows, which is fine for a video game and disastrous for an encryption key.
Step Three – Shaping The Output
What the algorithm actually produces is a raw number or a block of bits, which on its own means nothing to a program. The final step maps that raw value onto whatever the application needs, whether a decimal between zero and one, a whole number from one to a hundred, a playing card or a symbol on a reel.
Speed is the reason this approach dominates, since a pseudorandom generator can produce millions of values per second on ordinary hardware. A slot game leans on exactly that, running its generator continuously in the background so that the precise instant a player taps the button determines which value gets pulled and which symbols appear.
No part of that software checks how much anyone has lost, since the outcome was settled by arithmetic long before the animation caught up.
The Physical Alternative
Pseudorandomness has a permanent weakness, which is that it only ever looks random. To get the real thing you have to leave the deterministic world entirely and measure something physical, which is what a true random number generator does.
The noise sources engineers reach for are wonderfully varied:
- Thermal noise — the tiny electrical jitter in a resistor, harvested straight from the silicon.
- Radioactive decay — the timing of individual atoms breaking down, unpredictable by the laws of physics.
- Atmospheric noise — radio static picked up from the sky, used by public randomness services.
- Clock jitter — the microscopic drift between different oscillators inside a chip.
- Human mess — mouse movements, keystroke timings and disk delays, mixed into an operating system’s entropy pool.
Modern processors ship with this built in, and Intel’s RDRAND instruction returns numbers from an on-chip generator fed by thermal noise. The catch is throughput, since physical sources are slow, which is why the practical answer is a hybrid that harvests a little true entropy and uses it to seed a fast cryptographic generator.
The Wall Of Lava Lamps
The most charming entropy source sits in a corporate lobby in San Francisco, where Cloudflare keeps a wall of roughly a hundred lava lamps under a camera. The wax blobs follow fluid dynamics too chaotic to predict, and by Cloudflare’s own conservative estimate a single low-resolution frame yields around thirty thousand bits of entropy, with passing visitors adding a little more.
The idea is not new, having been patented by Silicon Graphics back in 1996, and the company has since added double pendulums in London and a sealed radioactive source in Singapore. None of it is the primary generator, since it serves as a backup and a public reminder that randomness must come from somewhere real.
When Randomness Fails
The reason all of this pedantry matters is that broken generators have caused some of the most spectacular failures in computing, and almost none of them involved a flawed algorithm. The entropy going in, rather than the maths itself, is nearly always the culprit.
A few cases have become required reading:
- Debian, 2008 — a maintainer removed two lines from OpenSSL, tying key generation to the process ID and leaving only 32,768 possible keys for nearly two years.
- PlayStation 3, 2010 — Sony reused the same value where a fresh random number was required, letting hackers recover the private key that signed all console software.
- Android wallets, 2013 — a weakness in the system’s secure generator let attackers drain Bitcoin from affected phones.
- Freshly booted servers — devices generating keys before collecting entropy produced RSA keys that researchers could break across a measurable slice of the internet.
- Keno, 1995 — a Nevada regulator with access to source code wrote a program predicting a keno generator’s numbers, and his accomplice hit an eight-number ticket worth $100,000 against odds of 230,000 to one.
That last case unraveled fast, since a jackpot that was improbably collected by a man showing no emotion drew immediate suspicion. The chilling detail running through all of them is that the broken output still passed casual inspection, because a bad generator rarely looks bad.
Proving A Generator Is Honest
Since flawed randomness looks fine to the naked eye, the only defence is systematic testing. Laboratories push billions of outputs through recognised statistical batteries, most famously the fifteen tests in the NIST SP 800-22 suite, hunting for repetitions, biases or patterns that should not exist.
Nothing here can prove a sequence is random, since the tests can only fail to find structure. In regulated fields such as gaming and lotteries, that statistical work is paired with a source-code review by an independent lab, precisely because the 1995 keno case showed what happens when the person who knows the algorithm best decides to use it.
The Machines That Learned To Surprise Us
A random number is never quite the accident it appears. It begins as a seed harvested from the physical world, passes through arithmetic built to scramble it beyond recognition, and emerges as a card, a key or a symbol on a reel.
The engineering matters because the stakes are real, protecting encrypted traffic, digital signatures and the fairness of every regulated game. Those games still carry a house edge no matter how clean the generator is, so anyone who finds their play becoming hard to control can seek free, confidential support from services such as GamCare or the National Council on Problem Gambling.
FAQ
Are computer random numbers really random?
Usually not. Most are pseudorandom, produced by a deterministic algorithm from a starting seed. True randomness requires measuring a physical process such as thermal noise or radioactive decay.
What is a seed in a random number generator?
The seed is the initial state the algorithm begins from. The same seed always produces the same sequence, so a guessable seed makes the entire output predictable to an attacker.
What is the difference between a PRNG and a TRNG?
A PRNG uses maths and is extremely fast but ultimately deterministic. A TRNG harvests physical noise and is genuinely unpredictable, though far slower, so systems often combine both.
Can a random number generator be predicted or hacked?
Yes, if the seed is weak or the algorithm is not cryptographically secure. Debian’s 2008 key flaw and the PlayStation 3 signing breach both came from exactly that kind of failure.
About the Author
