How Does a Computer Generate Random Numbers?

Or: Computers Are Surprisingly Bad at Making Things Up

Pick a number between 1 and 100. You can just do it — maybe you picked 37. Now tell a computer to do the same thing. It can certainly give you a number. But where did that number come from?

A computer follows instructions. Give it the same inputs and the same rules, and under ordinary computation you'd expect the same result. So how do you give a machine built around predictable rules an instruction that essentially means "do something unpredictable"?

The answer is one of computing's stranger hidden systems. Most of the time, computers don't generate random numbers in the way you might imagine. They generate numbers that are good enough at looking random that you can't easily tell the difference.

Computers Are Built to Be Predictable

A processor is extraordinarily deterministic. Perform 2 + 2 and you expect 4 every time. That consistency is fundamental — programs work because instructions behave the same way every time. If calculations sometimes randomly produced different answers, software development would become considerably more exciting than anyone wants.

But then we need computers to shuffle a playlist, generate a Minecraft world, spawn an enemy in an unexpected location, or create an encryption key. Now predictable behavior is exactly the problem.

Pseudorandom Number Generators

The most common solution is a Pseudorandom Number Generator, or PRNG. A PRNG is an algorithm that starts with an initial value and performs mathematical operations to produce a sequence of numbers that appears random. The key word is "appears." The algorithm itself is entirely deterministic — give it the same starting conditions and it produces the same sequence again.

That starting value is called the seed. Different seed, different sequence. Same seed, same sequence. The numbers look unrelated, but if you know the algorithm and the starting point, you can reproduce the entire output.

This sounds like a weakness. For some purposes it is. For others, it's exactly what's needed.

When Reproducibility Is a Feature

Games need enormous amounts of "randomness." Did the attack land a critical hit? Which item dropped? Where does the next dungeon room lead? A PRNG can provide those decisions quickly and consistently.

Minecraft players already understand seeds intuitively. The game uses a world seed as the starting point for procedural generation. Share that seed with another player and the same mountains, biomes, and structures appear in the same places. The game doesn't need to store a list of billions of individual block positions — the algorithm and seed together can regenerate the entire world.

This reproducibility is also valuable for debugging. If a particular procedurally generated dungeon configuration causes a crash, knowing the seed means the developer can recreate exactly those conditions and study the problem. Something being pseudorandom doesn't make it inferior — for many jobs, determinism is a feature.

When Predictability Becomes Dangerous

Security is different. Imagine a computer generating password-reset tokens, session identifiers, or encryption keys. If an attacker can determine the seed or reconstruct the generator's internal state, they may be able to calculate what values were produced or will be produced. That's not a theoretical concern — poor random number generation has caused real cryptographic failures.

For security-sensitive purposes, systems use Cryptographically Secure Pseudorandom Number Generators, or CSPRNGs. These meet much stricter requirements: seeing some output shouldn't make it practical to predict future values or reconstruct past ones. The difference matters enormously. A PRNG adequate for deciding whether a card game ends a particular way is completely unsuitable for generating a private key.

Think of shuffling cards. For playing Solitaire alone, a mediocre shuffle is perfectly fine. For an online poker game involving real money, a predictable shuffle is a catastrophe. Same operation, completely different consequences if randomness fails.

Where Unpredictability Actually Comes From

If the computer is deterministic, unpredictability has to come from somewhere outside the computation itself. That somewhere is the physical world.

Operating systems gather entropy — information containing genuine uncertainty — from the environment. Hardware events, timing variations, and physical processes produce measurements that an attacker can't easily know with precision. Modern processors often include dedicated hardware instructions that supply values derived from physical noise. The OS pools this entropy and uses it to initialize the random number system.

Cloudflare famously uses a wall of lava lamps in their San Francisco office as part of their entropy source. A camera captures the unpredictable movement of lava in the lamps; that visual data feeds into their cryptographic systems as additional randomness. It's not as eccentric as it sounds — the movement of lava in a lamp is genuinely difficult to predict precisely, which is exactly what entropy collection requires.

Software likes clean rules. Reality is noisy. That noise is the resource.

Humans Are Bad at Randomness Too

Here's a related wrinkle worth knowing. Randomness doesn't guarantee that short sequences look nicely mixed. Ten coin flips coming up all heads is unlikely but entirely possible. Forcing the system to avoid long streaks would actually make the output less random.

But humans instinctively expect randomness to look more evenly distributed than it actually is. Ask someone to invent a random-looking sequence and they'll avoid long runs — the result looks "random" to us but behaves less like actual randomness. This creates an interesting problem for game designers.

A weapon with a 25% critical-hit chance can mathematically miss ten times in a row. Players don't think "statistical variance" — they think the game is broken. So some games use modified systems that adjust probabilities behind the scenes to prevent extremely long streaks. The result feels more random to players even though it's mathematically less random. Developers aren't always simulating true randomness. They're simulating what people believe randomness should feel like.

What Random Numbers Are Actually Used For

Once you look, random values appear constantly. Encryption keys. Session tokens. Password salts (unique random data added to passwords before hashing, so two users with identical passwords produce different stored values). Authentication nonces. Procedural generation. Scientific simulations. Even playlist shuffles.

For most of these, pseudorandom numbers from a well-seeded PRNG are perfectly adequate. For security-critical applications, the output needs to be genuinely unpredictable — which is why those applications use CSPRNGs seeded with real entropy rather than simple algorithmic generators.

The required quality depends entirely on what you're protecting. "Random enough" means very different things for a game dropping loot and a server issuing authentication tokens.

The Bard's Take

Computers are extraordinary calculators. Give them a problem that would take a human a lifetime and they finish in seconds. But ask "do something I can't predict" and things get genuinely complicated.

The solution was pseudorandom number generators: mathematical systems that produce enormous sequences behaving enough like randomness to be useful. For games, simulations, procedural worlds, and countless everyday tasks, that's exactly what's needed — and the reproducibility is often a deliberate advantage.

For security, though, "looks random" isn't enough. The numbers need to be genuinely unpredictable. So computers gather entropy from the noisy physical world, combine it with carefully designed cryptographic algorithms, and use the result to generate values attackers can't guess.

Which means that every time a computer says "I randomly chose 64," there's a perfectly reasonable follow-up question: "Did you, though?"

Sometimes the honest answer is: no. I performed extremely clever mathematics that made 64 look like a surprise.

And in one of computing's stranger achievements — that's usually exactly what we wanted.

Sources

• How Do Lava Lamps Help with Internet Encryption? — Cloudflare
• Pseudorandom Number Generator — Wikipedia — Wikipedia
• How Computers Generate Random Numbers — How-To Geek
• Random Number Generation — NIST — NIST