How Random Number Generators Actually Work
Almost no software random number generator produces truly random output — here's how pseudorandom number generators actually work, and how a range like 1 to 100 gets produced from them.
Published July 20, 2026
Ask a computer to “generate a random number between 1 and 100” and it almost never involves anything genuinely unpredictable happening in the moment. Instead, a deterministic algorithm produces a long sequence of numbers that merely behaves statistically like randomness — a pseudorandom number generator, or PRNG.
The core idea: a seed produces a whole sequence
A PRNG takes a starting number (the seed) and repeatedly applies a mathematical formula to generate the next number in the sequence from the previous one. Given the identical seed, a PRNG produces the exact identical sequence of “random” numbers every single time — which sounds like the opposite of random, and mathematically is, but the output still passes the statistical tests that matter for most practical uses.
From a raw PRNG output to “a number between 1 and 100”
Result = (raw PRNG output mod 100) + 1
The modulo operation maps a huge raw number down into the target range — but naively done, this introduces a subtle bias.
Taking the raw output modulo the range size can very slightly favor lower numbers in the range, when the range doesn't evenly divide the generator's total output space.
Well-built random number libraries detect and discard results that would introduce this bias, re-rolling as needed to keep every number in the target range equally likely.
This bias — commonly called "modulo bias" — is a well-known, real pitfall in random number generation, particularly relevant in security-sensitive contexts. It's small enough to be invisible for something like a dice-roll app, but significant enough that cryptographic libraries specifically implement rejection sampling or similar techniques to avoid it entirely.
Why “random between 1 and 100” isn’t one universal method
| Use case | Typical generator type | Why |
|---|---|---|
| A game, quiz, or casual app | Standard PRNG (like Mersenne Twister) | Fast, statistically solid, doesn’t need unpredictability against an adversary |
| Security tokens, passwords, encryption keys | Cryptographically secure PRNG (CSPRNG) | Must be unpredictable even to someone who knows the algorithm |
| Scientific simulation | Seeded PRNG | Reproducibility (same seed = same results) is often a feature, not a flaw |
A standard PRNG is entirely adequate for rolling a virtual die or shuffling a playlist — nobody is trying to predict and exploit the sequence. For anything security-sensitive, a fundamentally different category of generator is required, covered in Pseudorandom vs. True Random Numbers Explained.
Where the seed itself comes from
Most everyday PRNGs seed themselves automatically from the system clock at startup, which is why re-running a random number request a moment later produces a different sequence — the seed itself changed, even though the underlying formula generating the sequence from that seed didn’t.
FAQ
If PRNGs are deterministic, why do they feel unpredictable in practice? Because the seed is effectively unpredictable to a casual user (it’s typically based on the exact system time down to the millisecond) and the sequence itself passes strong statistical randomness tests — for everyday purposes, the output is indistinguishable from true randomness even though it’s mathematically deterministic.
Is a specific number more likely to come up than another in a well-built generator? No — a properly implemented PRNG for a given range, using correct techniques to avoid modulo bias, produces every number in that range with equal probability, which is exactly the statistical property that makes it useful.
Can the same random number sequence ever repeat? Yes, eventually — every PRNG has a finite “period” after which its sequence repeats, though for modern algorithms that period is astronomically long, far beyond what any practical application would ever encounter.
Does this affect how a password strength calculator works? Indirectly — the Password Strength Calculator and Password Entropy Calculator measure how hard a password is to guess, which assumes any randomness used to generate that password came from an unpredictable, non-modulo-biased source in the first place.
Is there a way to generate truly random numbers on a computer? Yes, using unpredictable physical phenomena as an entropy source rather than a deterministic formula — a genuinely different approach covered in the companion article on pseudorandom vs. true randomness.
Does seeding with the current time make a PRNG cryptographically secure? No — even an unpredictable-seeming seed doesn’t make a standard PRNG safe for security purposes, since the algorithm itself may still be predictable once even a few outputs are observed, which is exactly why CSPRNGs use fundamentally different, specifically hardened algorithms.