How to Generate Random Numbers

Problem

You need random numbers for security purposes, testing, or simulation, and must ensure proper randomness.

Prerequisites

• Understanding of PRNG vs CSPRNG
• Knowledge of random number ranges

Steps

1. 1. Choose the right generator

   For security purposes (tokens, keys, passwords), use a cryptographically secure PRNG (CSPRNG): crypto.getRandomValues in browsers, crypto.randomBytes in Node.js. For non-security uses (testing, simulation), Math.random is faster but not secure. Never use Math.random for security.

   Input

   purpose: security token

   Output

   use CSPRNG

2. 2. Generate within the desired range

   For a random integer in [min, max], generate random bytes and map to the range. Avoid modulo bias: use rejection sampling or generate enough bits to cover the range uniformly. For random floats in [0, 1), divide a large random integer by its maximum value.

   Input

   range: [1, 100]

   Output

   42 (uniform)

3. 3. Generate other random types

   For random bytes (e.g., for a key), generate the required number of bytes directly. For random hex strings, convert the bytes to hex. For UUIDs, use the dedicated UUID generator. For random selections from an array, use a random index.

   Input

   32 random bytes

   Output

   a1b2c3... (64 hex chars)

Expected result

Random values generated with the appropriate level of security and uniformity.

Common errors

Modulo bias when using % to range

Using randomNumber % range produces biased results when the range doesn't evenly divide the generator's range. Use rejection sampling or crypto.randomInt for unbiased results.

Using Math.random for security

Math.random is predictable and not cryptographically secure. Always use crypto.getRandomValues or crypto.randomBytes for security-sensitive randomness.

Troubleshooting

• If random values seem predictable, verify you are using a CSPRNG.
• For large numbers of random values, check the distribution for uniformity.

Security limits

• All random generation is local. No random values are transmitted.
• CSPRNG output is unpredictable and suitable for security tokens, keys, and nonces.