🔬How Random Is Random?

By the WheelJar editorial desk

Two different jobs called “random”

Software has two kinds of random number generator, and they are built for opposite purposes.

A PRNG — pseudo-random number generator — is an algorithm that turns a small internal state into a long sequence of well-spread numbers. It is deterministic: the same starting state always gives the same sequence. That is a feature for games and simulations, where you often want to reproduce a run exactly, and it makes the generator very fast. Math.random is one of these.

A CSPRNG — the C standing for cryptographically secure — is built so that an observer who has seen a great deal of the output still cannot predict the next value or reconstruct the previous ones. It is seeded from operating-system entropy: timing jitter, hardware sources, whatever the platform collects. crypto.getRandomValues is the browser’s interface to it, and it is the same machinery that generates encryption keys.

For a spinning wheel deciding who does the washing up, the difference is academic. For a draw where somebody wins something, it is the difference between a generator designed to be unpredictable and one that merely looks it. Since the secure version costs essentially nothing, there is no reason to use the other.

The bug that hides in one character

Getting an unpredictable source is the easy half. The half that catches people out is fitting it to your range.

Suppose you want a number from 0 to 5 — a die. You take a random byte, which is a value from 0 to 255, and you write byte % 6. It looks obviously correct. It is not.

256 divided by 6 is 42 remainder 4. So the byte values map onto the six outcomes like this:

A uniform die would give 16.67% to every face. Here, four faces are about 2.4% more likely than the other two. In ten rolls you would never see it. In a million rolls it is unmistakable, and in a draw with real entries it means the people at the top of your list are quietly favoured.

The fix is rejection sampling, and it is almost embarrassingly simple: throw the awkward values away. The largest multiple of 6 that fits inside 256 is 252, so accept bytes 0 to 251 and redraw whenever you get 252, 253, 254 or 255. That discards 4 values in 256 — about 1.6% of draws — and what remains divides perfectly. Every tool on this site does this, which is why the random number generator can claim a genuinely flat distribution across any range you set.

Shuffling is where good intentions go wrong

The same trap has a shuffling version, and it is even more common.

The tempting one-liner is to sort the list with a comparator that returns a random result. It reads beautifully and it is wrong: sort algorithms assume a consistent ordering, and feeding them a random one produces a distribution that favours certain arrangements. Worse, the output looks completely shuffled, so the bug survives review indefinitely.

Fisher–Yates is the correct answer and has been since 1938, when Ronald Fisher and Frank Yates described it for shuffling by hand. Richard Durstenfeld gave it the modern in-place form in 1964, and Knuth documented it in The Art of Computer Programming, which is why it also travels under his name. The procedure: walk backwards through the list, and at each position swap the item with one chosen uniformly from the positions at or before it.

One pass. Every one of the n! possible orderings equally likely — six items give 720 orderings, ten give 3,628,800, and each is drawn evenly. It is what the list randomizer runs, what deals the team generator, what shuffles the deck behind random card, and what builds the Secret Santa chain.

What none of this can tell you

Even a perfect generator produces sequences that look wrong to human eyes. Streaks are the classic case: five heads in a row happens about one time in 32, and a hundred flips without a single run of five would be the genuinely suspicious result. People asked to write down a “random” sequence produce far fewer repeats than chance does, which is exactly how fabricated data gets caught.

So the honest summary is that randomness cannot be verified by looking at it. It can only be verified by understanding where it came from — which is why the methodology page exists, and why is a coin flip really 50/50 is a story about physics rather than about a coin.