Random Number Generator

Good enough for a raffle. Never for a password.

This page uses mulberry32, a fast statistical pseudo-random generator: thirty-two bits of internal state pushed through a couple of multiplies and shifts. It produces a uniform, pattern-free stream and it passes the small statistical batteries generators are screened with. For picking a raffle winner, filling a lottery line, choosing who goes first, or sampling rows out of a spreadsheet, it is entirely sound.

It is not a cryptographic generator, and the difference is not a matter of degree. Thirty-two bits of state means there are about four billion possible states — a number a laptop can search exhaustively in a fraction of a second. Anyone who sees a couple of numbers from your draw can recover the state and then produce every number you are going to get next. A statistical generator is built to look random; a cryptographic one is built to resist someone trying to predict it, and only the second property is worth anything when the output is a secret.

So: passwords, passphrases, API keys, session tokens, salts, nonces, recovery codes, shuffled decks in a game played for money — none of them should come from this page, or from any page like it. Use a password manager, or a cryptographic generator directly: crypto.getRandomValues in a browser, crypto.randomBytes in Node, secrets.token_urlsafe in Python. Those are one line of code and they are the right tool. This one is not.

The one place a cryptographic generator does appear here is the seed: when you open the page or press New numbers, the starting value comes from your browser’s crypto.getRandomValues. That is only so two visitors do not land on the same draw. Everything after the seed is mulberry32, and mulberry32 is what the warning above is about.

How a number gets drawn

The generator emits a value between 0 and 1. Scaling that to a range is one line, and both ends are inclusive — 1 through 6 is six outcomes, not five.

With repeats allowed, that line runs once per number and nothing else is needed. With repeats off, the draw has to be made without replacement, and the obvious approach — draw a number, throw it away if you have seen it, try again — falls apart exactly when you need it. Picking all 100 numbers from 1 through 100 that way spends its final picks retrying dozens of times each, and picking 99 of them is worse still.

Instead the tool runs a partial Fisher–Yates shuffle. Imagine the whole range laid out in order; swap the first slot with a randomly chosen slot, then the second with a random slot from those remaining, and stop after as many swaps as you need numbers. Each swap costs the same regardless of how much is left, so 100 picks from 100 is no slower than 6. The range itself is never actually built — only the slots that get touched are recorded — which is why a range of a billion numbers costs nothing.

Six numbers from 1–100, seed 12345

Seeding mulberry32 with 12345 and drawing six distinct numbers from 1 through 100 gives 98, 32, 50, 83, 53, 39 — in that order, every time, on any machine. They add to 355, which is a mean of 59.1667; the lowest is 32 and the highest is 98.

Watch what changes when repeats are switched on but the seed is left alone: the same stream of random values now feeds a different rule, and the draw becomes 98, 31, 49, 82, 51, 35. The first number is identical because the first pick spans the full range either way. The rest drift apart because the unique draw is picking from a range that shrinks by one each time, so the same underlying value lands on a different number.

A mean of 59.1667 sitting above the range’s midpoint of 50.5 is not a fault. Six draws is a tiny sample, and a tiny sample of a uniform distribution wanders. Draw 100 numbers instead and the mean will sit far closer to the middle; that is what the sum and mean are shown for.

What this generator assumes

• Whole numbers only. There is no decimal mode, no weighting, and no distribution other than uniform — every number in the range is exactly as likely as every other.
• Both bounds are included. A range of 1 through 49 can produce a 1 and can produce a 49.
• The draw is a function of the seed alone. Nothing about the time, your device, or your session enters into it, which is what makes a shared link reproducible — and what would make it predictable if the seed were guessable.
• Leaving the seed blank means a fresh seed is drawn once, when the page loads, from the browser’s cryptographic generator. Reloading gives a different draw; pressing New numbers gives a different draw and writes the seed down.
• The generator’s output carries 32 bits of resolution. For ranges up to a few million that is uniform to well below any measurable bias; across the full billion-wide range the spacing between reachable values becomes visible in principle, and still irrelevant to anything this tool is for.

Random number FAQ

Sources and review notes

1. NIST SP 800-90A Rev. 1 — what a generator has to satisfy before it may be used for anything security-relevant
2. W3C Web Cryptography API — the specification for crypto.getRandomValues, the browser generator that supplies this page’s seed
3. R. Durstenfeld, “Algorithm 235: Random permutation”, Communications of the ACM 7(7), 1964 — the shuffle used for draws without repeats

The arithmetic on this page is exact and has no data behind it to go stale. The sources are cited for the boundary the page draws between a statistical generator and a cryptographic one, and for the shuffle, not for the numbers themselves.