Is Math.random() safe enough for passwords?

No. Math.random() uses a pseudorandom generator that leaks state and can be guessed. For anything security-critical use crypto.getRandomValues() (browser) or crypto.randomBytes() (Node), which the tool supports.

How many bits of entropy do I need?

Session tokens: 128 bits. API keys: 256 bits. CSRF tokens: 128 bits. One-time SMS codes: 20–30 bits (6–8 digits) since they expire quickly. The tool shows entropy in the footer.

What does "without replacement" mean?

That the same item cannot be drawn twice, like taking from a closed urn. Useful when you need several unique winners from the same list.

Can I reproduce the same sequence later?

Yes, if you supply a seed. Enable "seed" in settings and note the number; the same seed produces the same sequence every time. Cryptographically secure generators do not support seeds, only pseudorandom ones do.

/random

Random Number Generator - Pick random numbers

Generate random integers or decimals within a custom range locally in your browser.

Minimum (Min)

Maximum (Max)

Count of numbers to generate

Number Type

Generate unique numbers only (no duplicates)

How the random number generator works

This tool uses a pseudo-random number generator in the browser to generate numbers within the given interval:

The interval [Min, Max]: The generator includes both the minimum and maximum values you provide as possible outcomes.
Unique numbers: When choosing unique numbers, the generator ensures that no number appears more than once in the output. This requires that the range contains enough possible values to cover your requested count.
Integers vs Decimals: Integers are rounded to the nearest whole value. Decimals are generated as floating-point values, and you can specify the number of digits you want after the decimal point.

Is this cryptographically secure?

No, this tool uses standard JavaScript Math.random() for quick client-side generation. This is excellent for casual drawings, games, statistical simulations, or quick choices, but should not be used for security-sensitive purposes like passwords or cryptography.

About this tool

Random numbers are needed more often than people think: picking an advent-calendar winner, generating test IDs, ordering speakers, or making secure API keys. This tool gives you numbers, text strings, UUIDs, dice rolls, cards and names from several sources, all running in the browser. Simple needs use Math.random(), security-critical ones use crypto.getRandomValues() which is cryptographically strong. You can generate a single number between two bounds, or draw without replacement from a list you paste.

How to use it

Pick a type (integer, decimal, string, UUID, dice, card, etc.).
Set bounds or lengths as needed.
Enable "cryptographically secure" if the result will be used for passwords, tokens or the like.
Click "Generate", then copy or download the result.

Examples

Random integer 1–100

Output73

Pick a winner from a list

Input

Anna
Bjarne
Cato
Dorthe
Erik

OutputCato

Cryptographic string

Outputk3F9pQ7wL2xN8vRz

Generated with crypto.getRandomValues(), giving at least 128 bits of entropy for 16 alphanumeric characters.

Common use cases

Draw winners in contests and giveaways.
Generate test IDs and seed data for developer demos.
Decide the order in meetings, talks or sports.
Create one-time tokens for magic login links.
Roll virtual dice for board games without physical dice.

Frequently asked questions

Is Math.random() safe enough for passwords?: No. Math.random() uses a pseudorandom generator that leaks state and can be guessed. For anything security-critical use crypto.getRandomValues() (browser) or crypto.randomBytes() (Node), which the tool supports.
How many bits of entropy do I need?: Session tokens: 128 bits. API keys: 256 bits. CSRF tokens: 128 bits. One-time SMS codes: 20–30 bits (6–8 digits) since they expire quickly. The tool shows entropy in the footer.
What does "without replacement" mean?: That the same item cannot be drawn twice, like taking from a closed urn. Useful when you need several unique winners from the same list.
Can I reproduce the same sequence later?: Yes, if you supply a seed. Enable "seed" in settings and note the number; the same seed produces the same sequence every time. Cryptographically secure generators do not support seeds, only pseudorandom ones do.

Technical background

Computers are deterministic, so "randomness" must either be sourced from physical inputs (thermal noise, key-press timing, mouse movement, radioactive decay) or simulated deterministically from a seed. The browser and Node expose two APIs: Math.random() gives a 32-bit XorShift-style pseudorandom stream that is fast but predictable, while crypto.getRandomValues() (WebCrypto) draws from the OS’s secure pool (/dev/urandom on Linux, BCryptGenRandom on Windows, SecRandomCopyBytes on macOS). Passwords, tokens, one-time codes and encryption keys must always come from the secure source. Entropy is measured in bits: 128 bits is considered practically infeasible to brute-force and 256 bits leaves margin against quantum-adversarial attacks. Drawing from an alphabet, entropy is log2(alphabet size) · length, so 16 chars from alphanumeric (62 chars) gives 16·log2(62) ≈ 95 bits, while 24 chars gives 143 bits.

Result