Pseudorandom vs Cryptographic Randomness
Compare predictable generators with Web Crypto and learn when the difference matters. Review practical steps, examples, limits and privacy-aware checks before using the result.
Random Picker Tools · Editorial Policy · Published · Updated
Pseudorandom vs Cryptographic Randomness
A basic pseudorandom generator expands a predictable internal state, while a cryptographic generator is designed so outputs remain impractical to predict from prior results. Browser Web Crypto is the appropriate default for an interactive picker because users should not be able to anticipate the next selection.
Recommended process
- Identify the source of random bytes.
- Check whether prior outputs can reveal future values.
- Map bytes into the requested range without favoring some values.
- Use deterministic seeded generators only when repeatability is intentional.
Worked example
A classroom demonstration may intentionally use a seeded generator so every student can reproduce the sequence. A live prize picker has the opposite requirement: participants should not be able to calculate the next winner, so Web Crypto is more suitable.
What to check before using the result
- Math.random() is not a cryptographic source.
- Cryptographic output does not validate the input list.
- Reproducibility and unpredictability are different goals.
How the random step is handled
Random Picker Tools uses the browser Web Crypto API for selection, rejection sampling for unbiased integers and a Fisher–Yates shuffle for complete list orders. The organizer still controls eligibility, duplicate rules, consent, accessibility and legal requirements.
Privacy note
Normal picking and shuffling happen in the browser. Use initials or non-sensitive identifiers when possible, avoid unnecessary source data, and create a share link only when temporary server storage is appropriate.