What Is a Random Number Generator (RNG)?

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

A random number generator (RNG) produces values intended to be random or unpredictable. Computers usually create them with deterministic pseudorandom algorithms seeded with entropy, while hardware and physical RNGs obtain entropy from events such as electronic noise or atmospheric conditions.

The right RNG depends on the job. A repeatable simulation needs a different kind of generator from a password-reset token, cryptographic key, online game, or public prize draw.

#	Preview	Product	Price
1		Citadel Black Character Randomizer Dice Set - Randomize Class, Race, & Alignment for Characters or...	$9.97	Buy on Amazon
2		ROCK PAPER SCISSORS DICE GAME	$7.09	Buy on Amazon
3		Dungeon Helper Dice Character Creator Dungeon Master NPC Character Randomizer 6 Dice Set Tabletop...	$29.95	Buy on Amazon
4		TOYGER Coin Flip Dice (dice for Coin toss) for All TCG Players	$5.80	Buy on Amazon
5		Grevosea 7 Pcs Mini Dice Set, DND Dice Metal Micro Miniature Dice with EDC Keychain Case Portable...	$5.98	Buy on Amazon

What does “random” mean?

Randomness is not simply a sequence that looks chaotic. It describes measurable properties of outcomes and the process producing them.

• Uniformity: Every result has the same probability. A fair six-sided die gives each face a probability of 1/6.
• Independence: One result should not provide useful information about the next.
• Unpredictability: An observer should not be able to determine future results, especially in security applications.
• Distribution: Results may be uniform, weighted, normally distributed, or generated according to another specified pattern.

Random selection can also happen with replacement, where the same value may appear repeatedly, or without replacement, as when drawing cards from a shuffled deck. An RNG alone does not define which of these rules an application uses.

#1 Best Overall

Citadel Black Character Randomizer Dice Set - Randomize Class, Race, & Alignment for Characters or NPCs, Made for Dungeons and Dragons 5th Edition & Other Tabletop Role-Playing Games

$9.97

Buy on Amazon

How a random number generator works

Most computers do not physically roll a die every time software requests a number. A typical system collects unpredictable input, uses it to initialize or refresh a generator, and then expands that input into random-looking bits.

Physical or system entropy
          ↓
Entropy collection and health checks
          ↓
Seed or reseed a generator
          ↓
Cryptographic or statistical expansion
          ↓
Raw random bits
          ↓
Range or distribution conversion
          ↓
Application result

For example, a program may request a value from 1 through 6. The generator produces bits, and a range-conversion method maps those bits to one of the six possible results. A secure implementation must ensure that the mapping does not make some faces more likely than others.

NIST separates the main parts of random-bit generation into three publications: SP 800-90A covers deterministic random-bit generator mechanisms, SP 800-90B covers entropy sources, and SP 800-90C covers constructions combining entropy sources with deterministic generators. NIST lists SP 800-90C as final on September 25, 2025; SP 800-90A Rev. 2 was still listed as a pre-draft call for comments in the publication information reviewed in August 2026.

PRNG vs. CSPRNG vs. hardware RNG

What is a PRNG?

A pseudorandom number generator is deterministic. Starting from the same seed or internal state, it produces the same sequence. That is a feature for scientific experiments: recording the seed allows someone else to reproduce a simulation, investigate a bug, or compare two algorithms.

PRNGs are generally fast and inexpensive. They are useful for Monte Carlo calculations, randomized algorithms, game effects, test data, and procedural worlds. However, a long period or good-looking output does not make a PRNG secure. A generator can pass statistical tests while still allowing an attacker to recover its state.

Python’s ordinary random module, documented for Python 3.14.7, uses the Mersenne Twister. It has a period of 2**19937 - 1 and is fast and deterministic, but Python explicitly says it is unsuitable for cryptographic purposes. See the Python random documentation.

What is a CSPRNG?

A cryptographically secure pseudorandom number generator is designed so that an attacker cannot feasibly predict its output or reconstruct its state without the necessary secret information. It is usually deterministic after seeding, so “cryptographically secure” does not mean “true physical randomness.”

Rank #2

ROCK PAPER SCISSORS DICE GAME

$7.09

Buy on Amazon

Use a CSPRNG for password-reset links, session identifiers, API credentials, authentication challenges, salts, nonces, initialization vectors, cryptographic keys, and security-sensitive game or fairness systems. Use a platform API or vetted cryptographic library rather than designing a generator yourself.

What is a hardware or true RNG?

A hardware, true, physical, or nondeterministic RNG obtains entropy from a physical process. Examples include electronic or thermal noise, oscillator jitter, avalanche noise, radioactive decay, atmospheric noise, and photon or quantum measurements. Terminology varies: NIST may use nondeterministic random bit generator, or NRBG, for this category.

Physical does not automatically mean unbiased, secure, or reliable. A production system may need entropy estimation, conditioning, health tests, failure detection, monitoring, and reseeding. A secure design commonly uses physical entropy to seed a CSPRNG, which can then produce output efficiently.

Entropy and seeds

Entropy is the amount of uncertainty or unpredictability available to a generator. It is not simply the number of raw bits collected. Several apparently different inputs may be correlated, and a large volume of low-quality data does not necessarily provide much usable entropy.

A secure operating system normally collects entropy from trusted system and hardware sources, conditions or mixes it, seeds a CSPRNG, and reseeds as needed. A strong algorithm cannot compensate for a predictable seed.

Dangerous seed material includes the current time alone, process IDs, usernames, predictable counters, device identifiers, or a fixed value reused across installations. A fixed seed is useful for a simulation and dangerous for a password token.

How random numbers become ranges and distributions

Generators usually produce bits or integers, while applications need a particular result: a number from 1 to 6, a weighted winner, a normally distributed measurement, or a sample from a list.

Rank #3

Dungeon Helper Dice Character Creator Dungeon Master NPC Character Randomizer 6 Dice Set Tabletop Role-Playing Games D&D Compatible Dungeons Dragons Other TTRPG Instant Roll Game Master DM GM with Bag

• RAPID ROLL AN NPC: This 6-piece dice set allows you to easily create a Non-Player Character (NPC) in one quick roll! For use with your favorite tabletop roleplay game. Compatible with Dungeons and Dragons (D&D DND), Pathfinder, and other table top RPGs. Whether before or during your game, simply roll the entire set at once, and you instantly have a richly detailed NPC!
• UNIQUE, QUALITY RPG DICE SET: Includes 6 oversized quality resin dice, marbled black and red color, with high-contrast white lettering that is both engraved and painted. Easy to read, even in dim light. Includes one die each for Gender (D8), Race (D10), Class (D12), Alignment (D10), CR Level (D6), and Disposition (D6). Each die includes classic descriptive variables for NPCs. The dice average 27 mm in size and .8 oz in weight each (larger than most standard sets)
• HOW IT WORKS: Pick up the entire dice set, roll them all at once, and meet your next NPC! As a sample outcome, the dice might decide that you have a Female, Dwarf, Rogue, who is Lawful/Neutral, one challenge rating (CR) level above the party, and is Hostile toward the party. You can also randomize traits of an existing NPC or character by rolling a single or a few dice. With thousands of possible trait combinations, these dice fill your game world with a rich and varied cast of characters
• IMPROVE YOUR ROLEPLAY GAME: Running an RPG requires DMs to multitask; having to pause the game to consult tables or apps increases the number of tasks and distractions. This dice set quickly and conveniently eliminates one of those tasks. Enjoy increasing engagement with your players, reducing downtime, and easing DM mental fatigue. Whether you are new to running a game or you’re a seasoned GM, Dungeon Helper Dice: Character Creator adds enjoyment and ease to your game
• ARTISTIC AND COLLECTIBLE: Dungeon Helper Dice: Character Creator was designed by a sculptor and game developer with decades of experience as an RPG Game Master. This unique set will add style to your dice collection and excitement to your games. Makes a great gift for DMs, RPG fans, and dice collectors

$29.95

Buy on Amazon

Modulo bias

A common but flawed technique is:

random_value % n

This is biased when the source range is not evenly divisible by n. For example, mapping all 256 possible byte values into ten outcomes gives some outcomes 26 source values and others 25.

The usual correction is rejection sampling:

1. Draw a value from the source range.
2. Discard it if it falls in the incomplete upper portion of that range.
3. Map the remaining values evenly into the requested range.

Node.js documents that crypto.randomInt() avoids modulo bias. A library function that handles range conversion is safer than writing this logic repeatedly.

Weighted and non-uniform randomness

Random does not always mean equally likely. A simulation may require a normal distribution, a game may use weighted loot, and a survey may sample according to defined probabilities. The distribution must be specified and implemented separately from the question of whether the underlying random stream is secure.

Are computer-generated numbers really random?

For an ordinary PRNG, the precise answer is no: its output is deterministic once its internal state is known. It can nevertheless be statistically useful and appear random for its intended workload.

A CSPRNG is also normally deterministic after seeding, but it is designed to be computationally unpredictable to an attacker. A physical RNG obtains entropy from a process treated as nondeterministic, but its output can still be biased or mishandled.

“True,” “uniform,” and “secure” describe different properties. A physical source may be transformed into a biased distribution. A uniform PRNG may be predictable. A secure generator may need a separate rule to select winners without replacement.

Which RNG should you use?

For a public lottery or contest, fairness involves more than selecting a random value. Eligibility rules, weighting, duplicate handling, audit records, secure transport, commitments, and applicable legal requirements may all matter.

Rank #4

TOYGER Coin Flip Dice (dice for Coin toss) for All TCG Players

• Use these dice instead of coin-tossing. It's easier.
• Three faces are black, three faces are colored
• 1/2 chance, just like coin-toss
• Same design for all faces (just different colors) so that the chances are 100% half and half
• 4 dice (with 4 different colors) in a pack. It means you can "coin-flip" 4 times at once.

$5.80

Buy on Amazon

Practical examples

Python

Use the ordinary module for reproducible, non-security work:

import random

random.seed(12345)
print([random.random() for _ in range(3)])

random.random() returns a value in 0.0 <= X < 1.0. Do not use this module for passwords, keys, or authentication.

For secrets, use Python’s secrets module:

import secrets

token = secrets.token_urlsafe(32)
number = secrets.randbelow(100)  # 0 through 99
choice = secrets.choice(["red", "green", "blue"])

The documentation says 32 bytes was considered sufficient for the typical use case as of 2015; it is not a universal or permanent security rule.

Browser JavaScript

Use Web Crypto for security-related random values:

const values = new Uint32Array(4);
crypto.getRandomValues(values);
console.log(values);

Do not use Math.random() for tokens, passwords, keys, authentication challenges, or security decisions. For cryptographic keys, prefer a purpose-specific API such as crypto.subtle.generateKey(). Browser implementations and details can vary by platform. See MDN’s Web Crypto documentation.

Node.js

import { randomBytes, randomInt } from "node:crypto";

const token = randomBytes(32);
const dieRoll = randomInt(1, 7); // 1 through 6

Node.js v26.7.0 documents randomBytes() as producing cryptographically strong pseudorandom data. randomInt(min, max) uses an inclusive lower bound and exclusive upper bound, avoids modulo bias, and supports a range smaller than 2**48 with safe-integer bounds. See the Node.js crypto documentation.

Common RNG mistakes

• Using Math.random() for security: It is not a cryptographic generator.
• Using Python’s random module for passwords: It is intended for simulation and general-purpose randomness, not secrets.
• Seeding with the current time: An attacker may guess the seed.
• Reusing a security-sensitive seed: Repeated seeds can reproduce outputs.
• Using % n without checking bias: Use rejection sampling or a library routine such as randomInt().
• Assuming a UUID is a secret: Uniqueness does not automatically mean adequate unpredictability or protection from exposure.
• Treating statistical tests as a security certificate: Passing tests does not prove resistance to prediction or state recovery.
• Assuming hardware is automatically better: Hardware sources need validation, failure handling, and proper integration.
• Using a remote RNG to generate private keys: This adds trust, transport, availability, logging, and supply-chain risks.

Statistical randomness is not cryptographic security

Statistical tests ask whether frequencies, runs, correlations, and distributions look plausible. NIST SP 800-22 provides a statistical test suite for random and pseudorandom generators used in cryptographic applications.

Security analysis asks different questions: Can an attacker guess the next value? Can the seed or state be recovered? Can output be influenced? Does failure become detectable? Is the generator reseeded correctly? A sequence can pass statistical tests and still be unsuitable for cryptographic keys or authentication tokens.

What about RANDOM.ORG?

RANDOM.ORG describes its service as generating randomness from atmospheric noise. Its API can provide integers, sequences, strings, and related results, subject to usage guidelines and quotas. That can be useful for public demonstrations or externally explainable drawings where physical randomness and service provenance matter.

Best Value

Grevosea 7 Pcs Mini Dice Set, DND Dice Metal Micro Miniature Dice with EDC Keychain Case Portable Role Playing Dice Perfect Accessories, Tools & Gifts for D&D Player TTRPG Gamer or Dungeon Master

• Mini Dice Set D&D: The dice is very small, only about 6-9 mm, you can carry it with you. The game will appear spontaneously no matter where you are, and you'll never have to worry about not having a set of dice
• Easy to Carry: As avid dice rollers, we want the dice safe too. So we designed a metal case holding these small dice. The dice can now be carried with your keychain to any where safe and sound!
• Antique Metal Dice: The dice are high quality and unique. The dice are small, but are made of high-quality metal and have a good sense of weight to roll properly.
• Fair Play: Rest assured that each roll will be fair and unbiased with our well-balanced metal dice. Enjoy a level playing field and ensure an exciting gaming experience for everyone involved.
• Multi Purposes: Our dnd metal dice set Suitable for any RPG games, whether you're a seasoned player or just starting your journey, our Metal DND Dice Set is essential for any role-playing adventure,allowing you to immerse yourself in thrillingadventures!

$5.98

Buy on Amazon

It is a poor default for private cryptographic keys, offline systems, latency-sensitive workloads, or applications that cannot tolerate a third-party dependency. RANDOM.ORG’s FAQ specifically cautions users concerned about security against trusting another party to generate cryptographic keys. Its quotas and service terms can change.

Frequently Asked Questions

Is an RNG truly random?

It depends on the type. A PRNG is deterministic, a CSPRNG is designed to be computationally unpredictable after secure seeding, and a physical RNG obtains entropy from a physical process. None of those labels alone guarantees fairness or correct implementation.

Is Math.random() secure?

No. Use Web Crypto for browser security tasks, Python’s secrets module in Python, and Node’s crypto APIs on a server.

Why can a random result repeat?

Random selection commonly allows replacement, so repeated results are expected. Preventing duplicates requires a separate without-replacement selection rule.

Can a generator pass tests and still be insecure?

Yes. Statistical tests can reveal distribution problems but do not prove that an attacker cannot predict output or recover the generator’s state.

Is RANDOM.ORG suitable for private keys?

Generally no. A remote service introduces trust and operational risks; use a local operating-system CSPRNG or a vetted cryptographic library instead.

Quick Recap

Bestseller No. 1

Citadel Black Character Randomizer Dice Set - Randomize Class, Race, & Alignment for Characters or NPCs, Made for Dungeons and Dragons 5th Edition & Other Tabletop Role-Playing Games

$9.97

Bestseller No. 2

ROCK PAPER SCISSORS DICE GAME

$7.09

Bestseller No. 3

Dungeon Helper Dice Character Creator Dungeon Master NPC Character Randomizer 6 Dice Set Tabletop Role-Playing Games D&D Compatible Dungeons Dragons Other TTRPG Instant Roll Game Master DM GM with Bag

$29.95

Bestseller No. 4

TOYGER Coin Flip Dice (dice for Coin toss) for All TCG Players

Use these dice instead of coin-tossing. It's easier.; Three faces are black, three faces are colored

$5.80

Bestseller No. 5

Grevosea 7 Pcs Mini Dice Set, DND Dice Metal Micro Miniature Dice with EDC Keychain Case Portable Role Playing Dice Perfect Accessories, Tools & Gifts for D&D Player TTRPG Gamer or Dungeon Master

$5.98

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.