True Randomness vs. Pseudo-Randomness: What Your Random Number Generator Is Actually Doing

By Marcus Vane · October 9, 2026 · Calculators

The numbers your computer calls random are almost certainly deterministic, produced by an algorithm from a seed. That is fine for most purposes and dangerous for a few.

When you ask a computer for a random number, what you usually get is not random at all in the strict sense. It is the output of a deterministic algorithm that, given the same starting seed, always produces the same sequence. This is called pseudo randomness, and it is the right tool for the overwhelming majority of tasks. The trouble is that the few cases where it is the wrong tool, cryptography above all, are exactly the cases where getting it wrong has serious consequences. Knowing which kind of randomness you need is the whole decision.

In this article:

What pseudo random actually means

A pseudo random number generator is an algorithm that takes a seed value and produces a sequence of numbers that pass statistical tests for randomness: they are uniformly distributed, lack obvious patterns, and satisfy tests for independence. But the sequence is entirely determined by the seed. Supply the same seed twice and you get the same sequence twice, which is why pseudo random generators are useful for reproducible simulations and testing. The numbers look random and behave random under statistics, but they are not unpredictable to someone who knows the seed and the algorithm.

Where true randomness comes from

True randomness is drawn from physical processes that are fundamentally unpredictable, such as thermal noise in a circuit, the timing of radioactive decay, or the jitter in user input events. A computer can harvest these sources into an entropy pool and produce numbers that are not just statistically random but unpredictable even to an attacker who knows the algorithm. Most operating systems provide a cryptographically secure random source that combines entropy harvesting with a secure algorithm, producing output suitable for secrets.

When pseudo random is fine

For simulations, games, shuffling a playlist, generating sample data, picking a winner in a casual draw, and any case where you want unpredictability but not secrecy, a pseudo random generator is appropriate and often preferable because it is fast and reproducible. If you seed it with the current time, the sequence varies between runs, which is all the unpredictability these tasks require.

When you need a CSPRNG or true randomness

For anything that protects a secret, you need a cryptographically secure pseudo random number generator or true randomness. This includes passwords, API keys, session tokens, encryption keys and password reset codes. A standard pseudo random generator is predictable from its seed, and if the seed is the current time, an attacker who knows roughly when the value was generated can reproduce it by trying a small range of seeds. Cryptographic generators draw from the system entropy pool and resist this kind of prediction, which is why they are the only correct choice for security.

Worked examples

Example one: shuffling a playlist

A music app shuffles a playlist by seeding a pseudo random generator with the current time and applying the resulting sequence to the track order. The shuffle looks random to the user, and reproducibility is irrelevant. This is a correct use of pseudo randomness: no secret is at stake, and speed matters.

Example two: generating a password

A password generator that uses a standard pseudo random generator seeded with the current millisecond produces passwords that look strong but are predictable. An attacker who knows the generator was seeded at, say, between one billion seven hundred million and one billion seven hundred million plus one thousand, needs to try only one thousand seeds to reproduce every password produced in that second. A cryptographic generator seeded from system entropy makes this attack infeasible, which is why password generation must use the secure source.

Example three: a reproducible simulation

A researcher running a Monte Carlo simulation records the seed used so the run can be reproduced exactly by reviewers. Here pseudo randomness is not just acceptable but required, because true randomness would make the result impossible to verify. The seed is published alongside the results, and reproducibility is the point.

Common mistakes

FAQ: randomness edge cases

Can I make a pseudo random generator secure by using a better seed?

Not safely. Even with a good seed, a standard generator's internal state can be reconstructed from enough output. Use a generator designed and vetted for cryptography, which resists state recovery.

Is true randomness always better?

Not always. True randomness is slower, not reproducible, and sometimes biased. For most software, a cryptographic generator that mixes entropy with a secure algorithm is the practical best of both.

How much entropy does a password need?

The entropy comes from the size of the character set and the length, not from the generator type, but the generator must be unpredictable so an attacker cannot reproduce the output. A cryptographic generator ensures the entropy you designed in is actually delivered.

Wrapping up

Pseudo randomness is deterministic but statistically random, and it is the right choice for anything that needs unpredictability without secrecy. Cryptographic randomness, drawn from system entropy, is the only correct choice for passwords, keys and tokens. Match the generator to the stakes, and never let a time seeded pseudo random generator near a secret.

Generate random PINs and codes for everyday use.

Try the PIN Generator tool.

SwiftMultiTool — free online tools for everyone. Home · Blog · About · FAQ · Contact