Pseudo-Random vs True Random Numbers: What Is the Difference?

Two ways to make a random number

A true random number generator takes its randomness from a physical process that cannot be reproduced on demand, such as electrical noise, radioactive decay or atmospheric noise. A pseudo-random number generator (PRNG) is an algorithm: it starts from a starting value called a seed and applies a formula to produce a long sequence that looks random.

The defining difference is repeatability. Give a PRNG the same seed and it produces exactly the same sequence every time. A true source has no seed to replay. The service RANDOM.ORG, which generates numbers from atmospheric noise picked up by a radio, describes the trade-off like this: pseudo-random generators are fast and deterministic and eventually repeat, while true generators are slower and nondeterministic and have no repeating period.

Why pseudo-random is usually good enough

For most purposes, a good PRNG is an excellent choice. Its output passes statistical tests: each value appears about as often as any other, and there are no obvious patterns. Because it is fast and reproducible, it is the right tool for simulations, video games and scientific experiments, where being able to rerun the exact same “random” sequence is a feature, not a flaw.

A well-known example is the Mersenne Twister. Its period is 2 to the power of 19,937, minus 1, a number with around 6,000 digits, so it will not repeat in any practical sense. It is the default generator in a number of programming languages and applications, according to its reference entry. But the same entry points out that it is not cryptographically secure: once someone has observed 624 consecutive outputs, they can work out its internal state and predict everything that follows.

The problem with predictability

Predictability is what separates ordinary pseudo-randomness from the kind needed for security or fair draws. If an observer can work out what comes next, then the numbers are no longer random to that observer, however good they look statistically.

That is why there is a third category between the two: the cryptographically secure pseudo-random number generator (CSPRNG). It is still an algorithm, but it is designed so that, even if you see a long stretch of its output, you cannot work out earlier or later values in any feasible time. It is also seeded with unpredictable material gathered by the operating system, from sources such as hardware events, so the starting point cannot be guessed.

What your browser provides

Web browsers offer two different functions, and the difference matters:

• Math.random() returns a number between 0 and 1. The browser chooses the algorithm, and the documentation states that it does not provide cryptographically secure random numbers and should not be used for security.
• crypto.getRandomValues() fills an array with random values. MDN explains that browsers implement it with a pseudo-random generator seeded with enough entropy from an external source, and that the result is suitable for cryptographic purposes.

Notice what the second description admits: even the secure function is, strictly speaking, pseudo-random. Browsers do not wait for a physical coin to flip. But the generator is seeded from the operating system’s entropy pool, which continually collects unpredictable data, and this makes its output practically impossible to predict.

Does the difference matter for a wheel?

For picking a name from a list, the honest answer is that either kind would give results that look the same to anyone watching. The practical advantages of a secure source are about trust rather than visible quality. Nobody can study earlier spins and forecast the next one, and nobody can claim that a clever script could have rigged the draw. A wheel picker such as this one therefore uses crypto.getRandomValues(), not Math.random().

True hardware randomness would bring no visible benefit here. It would require a special device or a remote service, and a remote service would mean sending your list or request over a network. A local, operating-system-seeded generator keeps everything inside your browser.

Common misunderstandings

“Pseudo-random means biased.” Not at all. A decent PRNG gives each outcome the same probability. “Pseudo” describes how the numbers are made, not how fair they are.

“Random means evenly spread in the short run.” Real random sequences contain streaks. Five entries can produce the same winner three times in a row, and that is perfectly normal; a generator that avoided streaks would be less random. A small number of spins will almost never give each entry exactly its fair share.

“A secure generator guarantees a fair result.” It guarantees unpredictable numbers. Turning those numbers into a choice must also be done carefully; a common mistake, called modulo bias, makes some entries very slightly likelier than others unless the code rejects the uneven leftover values. And the list itself must be fair, with every eligible entry present once.

Choosing the right source

As a rule of thumb: use a seeded PRNG when you want repeatable results, such as testing or simulations; use a CSPRNG for anything where predictability would cause harm, including passwords, keys and prize draws; and reserve dedicated hardware sources for specialised needs. For everyday fun, a wheel is a low-stakes tool, and the choice of generator just means that nobody can second-guess the outcome.

If a draw has real money or legal rules attached, remember that requirements vary by country and platform and should be checked by the organiser. Nothing here is legal advice.