Pseudorandom vs. True Random Numbers Explained
The real difference between a pseudorandom number generator and a true random number source, why the distinction is invisible for a game but critical for security, and how true randomness is actually captured.
Published July 20, 2026
Pseudorandom and true random numbers can look statistically identical in a spreadsheet — both pass the same randomness tests, both appear evenly distributed. The difference only shows up in a specific, critical scenario: whether the sequence could be predicted by someone who wanted to.
The core distinction
A deterministic formula generates the sequence from a seed. Given the seed, the entire future sequence is fully predictable.
Derived from an unpredictable physical process. Even knowing everything about the system in advance doesn't let you predict the next value.
Where true randomness actually comes from
Real hardware random number generators pull entropy from genuinely unpredictable physical sources — atmospheric radio noise, tiny fluctuations in electronic circuit noise, radioactive decay timing, or in some systems, precise timing jitter between hardware events. These processes aren’t just “hard to predict with current tools” the way a good PRNG’s output is — they’re understood to be fundamentally unpredictable at the physical level being measured.
Why the distinction rarely matters — until it does
There have been real, documented security failures traced directly to using a standard (non-cryptographic) PRNG somewhere it needed true or cryptographically secure randomness — an attacker who can guess or reconstruct the seed and algorithm can predict every "random" value the system will ever generate, including supposedly secret keys. This is exactly why cryptography standards treat this distinction as critical, not academic.
The middle ground: cryptographically secure PRNGs
| Type | Deterministic? | Predictable from partial output? | Typical use |
|---|---|---|---|
| Standard PRNG | Yes | Often yes, with enough observed output | Games, simulations, general software |
| CSPRNG (crypto-secure PRNG) | Yes, but seeded from true randomness and algorithmically hardened | Designed to be practically infeasible | Passwords, tokens, encryption keys |
| TRNG (true random) | No | No | Seeding CSPRNGs, high-security applications |
A CSPRNG is still technically a deterministic algorithm underneath, but it’s specifically designed so that observing its output doesn’t reveal the internal state or let anyone predict future values — and it’s typically seeded using true randomness gathered from the operating system, combining the practical speed of a PRNG with security properties much closer to true randomness.
FAQ
Is JavaScript’s Math.random() safe to use for passwords? No — it’s a standard, non-cryptographic PRNG in virtually every implementation, suitable for games and general use but explicitly not designed or recommended for anything security-sensitive; a CSPRNG-specific function should be used instead.
How does a computer capture “true” randomness from something like circuit noise? Specialized hardware measures a genuinely unpredictable physical signal (like electronic thermal noise) and converts fluctuations in that signal into a stream of random bits, which then typically feeds into further processing to remove any residual statistical bias.
Does true randomness ever need statistical bias correction too? Yes — raw physical entropy sources sometimes have small statistical biases (like being slightly more likely to produce a 1 than a 0), and standard techniques exist to “whiten” this raw data into a more uniformly distributed final output.
How does this connect to a random-number-between-1-and-100 style generator? See How Random Number Generators Actually Work for how a typical everyday random number tool is built — almost always on a standard PRNG, not true randomness, since true randomness generation is unnecessary overhead for non-security use cases.
Why not just always use true randomness to be safe? True random number generation is typically slower and requires specialized hardware or operating system support, making it impractical or unnecessary overhead for the vast majority of everyday uses where predictability isn’t actually a risk.
How does this relate to password strength? The Password Entropy Calculator measures how unpredictable a password is based on its character set and length — that measurement assumes the password was generated (or chosen) with genuine unpredictability in the first place, which is exactly where the PRNG-vs-true-random distinction matters in practice.