Random Numbers Aren't Really Random

In the lobby of Cloudflare's San Francisco office, a wall holds roughly 100 lava lamps. A camera photographs them, and the unpredictable swirls of wax, along with changes in light and people walking by, are turned into data used to help seed the company's encryption systems.

Why would an internet security company rely on lava lamps? Because computers, left to themselves, can't produce true randomness. Most of the "random" numbers in your games, simulations and apps are calculated by a formula, and if you know the formula and its starting point, you can predict every one of them.

A Computer's Randomness Is Completely Predictable

A computer is a deterministic machine. Given the same inputs, it produces the same outputs. So a function like random() can't be truly random. It's a pseudorandom number generator (PRNG): an algorithm that produces numbers that look random and pass statistical tests, but are entirely determined by an initial value called the seed.

Use the same seed, and you'll get exactly the same "random" sequence every time. That's not a flaw. It's often useful: scientists re-run simulations with the same seed to reproduce results, and games use seeds to regenerate identical worlds.

An Insider Reference: "A State of Sin"

In 1949, at a symposium on Monte Carlo methods, mathematician John von Neumann made a famous remark:

Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin.

He wasn't against them. He'd just devised one, the middle-square method: square a number and take the middle digits as the next number. His point was that calculated numbers aren't random, and users should never forget it. The middle-square method itself turned out to have serious flaws, often falling into short cycles or collapsing to zero.

Before computers, researchers needing randomness used published tables. In 1955, the RAND Corporation released A Million Random Digits with 100,000 Normal Deviates, generated with an electronic roulette wheel. It became a standard reference for scientists and engineers for years.

True Randomness: From Physics

True random number generators (TRNGs) measure unpredictable physical processes:

• Electronic noise: tiny, random voltage fluctuations in circuits
• Radioactive decay: the timing of individual decays is fundamentally unpredictable
• Atmospheric noise: the service RANDOM.ORG, started in 1998 by Mads Haahr of Trinity College Dublin, generates numbers from radio static
• Chaotic systems: like Cloudflare's lava lamps

Modern CPUs include hardware random number generators based on electronic noise, such as Intel's RDRAND instruction. Operating systems combine these and other unpredictable events, like precise timings of interrupts, into an entropy pool used to seed cryptographic generators.

When Predictable Randomness Goes Wrong

The Debian OpenSSL Bug

In 2006, a maintainer of the Debian Linux distribution removed two lines of code from the OpenSSL cryptography library to silence warnings from a code-analysis tool. Those lines happened to be where most of the randomness was mixed in.

For almost two years, affected systems generated encryption keys whose only real variation came from the process ID, which could take at most 32,767 values. That meant only about 32,767 possible keys per key type and size. Attackers could simply precompute all of them. The flaw was discovered and disclosed in May 2008, forcing a massive replacement of keys worldwide.

Predictable Seeds

Seeding a generator with the current time is common in simple programs. But if an attacker knows roughly when a seed was chosen, they can try every second or millisecond in that window. Early online poker and lottery systems have been broken exactly this way.

Humans Aren't Random Either

People are even worse random number generators than computers. When asked to write random coin flips, people:

• Avoid long streaks, even though streaks of 5 or 6 are common in 100 real flips
• Alternate too often between heads and tails
• Pick certain "random-looking" numbers, like 7 or 37, far more than others

Randomness can also feel wrong. In 2014, Spotify engineers wrote that users complained its shuffle wasn't random because the same artist sometimes played twice in a row. True randomness produces clusters like that. So Spotify changed its algorithm to spread artists out, making it less random but more satisfying.

How We Test Randomness

Since you can't prove a sequence is random, you test whether it behaves randomly. Statistical test suites check things like:

• Are all digits equally frequent? (a chi-squared test)
• Are runs of repeated values as common as they should be?
• Are successive values uncorrelated?

The U.S. National Institute of Standards and Technology publishes a well-known suite of such tests. Good PRNGs pass them. Passing the tests shows a sequence looks random, not that it's unpredictable. See the testing ideas behind this in the statistics formulas.

Two Concepts Worth Knowing

Entropy

In computing, entropy measures unpredictability, in bits. A truly random 128-bit key has 128 bits of entropy. A key derived from a 15-bit process ID has at most 15 bits, no matter how long the key looks.

Seed

A seed is the starting value of a pseudorandom generator. The same seed always produces the same sequence. For security, the seed must come from a high-entropy source.

Quick Answer: Are Computer Random Numbers Truly Random?

Usually not. Most computer random numbers come from pseudorandom generators: deterministic formulas that produce random-looking sequences from a starting seed. True randomness requires physical sources like electronic noise, radioactive decay or atmospheric static, which are used to seed secure generators.

Try Them Yourself

• Random Number Generator: generate numbers and look for patterns
• Statistics Formulas: tests for randomness
• Z-Score Calculator: how unusual is a streak?
• Standard Normal Table: probabilities behind randomness tests
• Why Prime Numbers Matter to Modern Cryptography: what happens when keys aren't random enough
• Pseudo-Random Numbers Explained: how the formulas work

Write down 100 "random" coin flips from your head, then flip a real coin 100 times. Count the longest streak in each. Your head almost certainly produced the shorter one.