Pseudorandom vs Cryptographic Randomness
Compare predictable generators with Web Crypto and learn when the difference matters.
Published · Reviewed
Pseudorandom vs Cryptographic Randomness
A basic pseudorandom generator expands a predictable internal state, while a cryptographic generator is designed so outputs remain impractical to predict from prior results. Browser Web Crypto is the appropriate default for an interactive picker because users should not be able to anticipate the next selection.
Recommended process
- Identify the source of random bytes.
- Check whether prior outputs can reveal future values.
- Map bytes into the requested range without favoring some values.
- Use deterministic seeded generators only when repeatability is intentional.
Worked example
A classroom demonstration may intentionally use a seeded generator so every student can reproduce the sequence. A live prize picker has the opposite requirement: participants should not be able to calculate the next winner, so Web Crypto is more suitable.
What to check before using the result
- Math.random() is not a cryptographic source.
- Cryptographic output does not validate the input list.
- Reproducibility and unpredictability are different goals.
How the random step is handled
Random Picker Tools uses window.crypto.getRandomValues() for browser-based selection. Integer results use rejection sampling to avoid modulo bias, and complete list orders use a Fisher–Yates shuffle. This addresses the software selection step; the organizer still controls eligibility, duplicate rules, consent, accessibility and any legal requirements.
Privacy note
Normal picking and shuffling happen in the browser. Use initials or non-sensitive identifiers when possible, avoid storing unnecessary source data, and create a share link only when temporary server storage is appropriate for the people represented in the list.