How Random Are Random Numbers in Programming? The Truth About Pseudorandomness

Every time you shuffle a playlist, roll dice in a video game, or receive a security token for two-factor authentication, you're relying on random numbers. But here's the uncomfortable truth: most random numbers generated by computers aren't random at all. They're pseudorandom—produced by deterministic algorithms that only appear random.

The Illusion of Randomness

According to Wikipedia, a Pseudorandom Number Generator (PRNG) is an algorithm that generates a sequence of numbers whose properties approximate random numbers, but the sequence is completely determined by an initial value called a seed. Give a PRNG the same seed twice, and it will produce the exact same sequence of "random" numbers every time. This predictability is why they're called pseudorandom rather than truly random.

The reason computers struggle with true randomness is fundamental: computers are deterministic machines designed to follow instructions precisely and produce consistent results. As GeeksForGeeks explains, "it is not possible to generate truly random numbers from deterministic thing like computers," so PRNGs use mathematical formulas to simulate randomness.

How PRNGs Work: Common Algorithms

The most basic PRNG algorithm is the Linear Congruential Generator (LCG), which uses a simple formula: the next random number equals (a × previous number + b) mod m, where a, b, and m are constants. According to FreeCodeCamp, this method was used by Java until 2020 despite being considered low quality by modern standards.

More sophisticated algorithms include the Mersenne Twister, widely used in scientific computing for its long period before repeating (2^19937-1), and cryptographically secure PRNGs like Microsoft's CryptGenRandom, the Yarrow algorithm used in macOS, and Fortuna. For security applications, wolfSSL implements SHA2-256 Hash_DRBG described in NIST's SP 800-90A specification.

Can You Predict the Next Number?

Yes—theoretically. Lenovo's technical glossary states: "In theory, if you have knowledge of the specific pseudorandom number generator algorithm and its seed, you can predict the entire sequence of pseudorandom numbers it will generate." However, modern cryptographically secure PRNGs are designed to resist prediction even if you observe previous outputs. The security relies on keeping the seed secret and using algorithms where deducing future numbers from past outputs is computationally infeasible.

The NSA famously exploited this weakness. According to Wikipedia, it's been shown the NSA likely inserted a backdoor into the NIST-certified PRNG called Dual_EC_DRBG, allowing them to predict "random" numbers generated by systems using that algorithm. This incident highlights why algorithm choice matters critically for security applications.

When to Use (and Not Use) Pseudorandom Numbers

Use PRNGs for: Video games, simulations, Monte Carlo methods, procedural generation in graphics, shuffling playlists, and any application where reproducibility is valuable. PRNGs are fast, efficient, and perfect when you need many random numbers quickly without security concerns.

Don't use standard PRNGs for: Cryptography, password generation, security tokens, gambling, lottery systems, or any application where unpredictability is critical. According to wolfSSL, these applications require either True Random Number Generators (TRNGs) or cryptographically secure PRNGs specifically designed to resist prediction attacks.

True randomness comes from unpredictable physical processes—radioactive decay, thermal noise, atmospheric noise, or quantum phenomena. Modern processors often include hardware TRNGs (like Intel's RDRAND instruction) that measure quantum-level physical randomness. However, TRNGs are slower and more expensive than PRNGs. The practical solution, as explained by UC Berkeley's Computer Security textbook, is using a small amount of true randomness as a seed for a cryptographically secure PRNG, which then "stretches" that randomness into a long sequence of computationally indistinguishable pseudorandom bits.

The seeding process matters enormously. Many developers seed PRNGs with the current time (milliseconds since January 1, 1970), but if an attacker knows approximately when your program ran, they can brute-force the seed and reproduce your entire "random" sequence. Better seeds come from combining multiple unpredictable sources: system entropy pools, hardware random number generators, and timing of unpredictable user actions like mouse movements or keystrokes.

The bottom line: random numbers in programming exist on a spectrum from completely predictable (bad PRNGs with known seeds) to computationally indistinguishable from true randomness (cryptographically secure PRNGs with unpredictable seeds) to genuinely unpredictable (hardware TRNGs measuring quantum phenomena). Understanding this spectrum is crucial for choosing the right random number source for your application—and recognizing when "random" isn't random enough.