b2KIT

Secure Random Number Generator

Generate cryptographically secure random numbers within custom ranges using the Web Crypto API.

Tested tool guide Tested browser tools Checked August 16, 2026

What Secure Random Number Generator does and how it behaves

This tool returns random integers inside a range you set, drawn from the Web Crypto API's getRandomValues rather than Math.random(), which is not cryptographically secure. Values are uniformly distributed across the whole range because the generator uses rejection sampling instead of the modulo shortcut that quietly biases naive random-number code. Everything happens in your browser, and no input or output is sent anywhere. The usual surprise is that security is in the source and the method, not in the digits: the output looks like any other random number, yet only this kind of generator is defensible for tokens, draws, and codes that must not be predictable.

How the result is produced

1

Where the bytes come from

Random bytes come from crypto.getRandomValues(), a Web Crypto API method specified to use a cryptographically secure pseudo-random number generator seeded with device entropy, the same class of source that backs TLS session keys. The specification caps a single call at 65,536 bytes, so larger outputs are generated in batches; unlike the rest of the Web Crypto API, getRandomValues stays available on non-HTTPS pages.

2

Mapping to a range without bias

Raw random bytes are uniform from 0 to 255, but a range rarely divides evenly, so a bare modulo would make a few low values slightly more likely than others. An unbiased mapping uses rejection sampling: a draw that lands in the leftover part of the byte space is discarded and drawn again, keeping every integer in the range equally likely. Bias would shrink the space an attacker must search.

Good uses

  • Drawing a winner in a raffle, lottery, or contest where the result must be fair and impossible to predict in advance, and participants may scrutinize the method afterward.
  • Creating numeric secrets such as PINs, one-time codes, or account-recovery numbers, where an attacker who can guess the generator has a real advantage.
  • Unbiased sampling and randomization for statistics and testing: assigning A/B test groups, picking survey respondents, or choosing a random index where even a small skew corrupts the result.

Limits and checks

  • Boundary ambiguity: confirm whether the range is inclusive at both ends before trusting a draw. If '1 to 6' might mean 1 through 5 or 1 through 6 depending on convention, state the range explicitly and test both endpoints with a few runs.
  • A secure source does not enlarge a small space: a random PIN from 0-9,999 still has only 10,000 possibilities, and a 4-digit code is brute-forceable no matter which generator produced it. Security is about unpredictability, not range size.
  • Single draws are unverifiable by design: repeats, runs, and patterns in the output are consistent with perfect randomness, so they are not signs of failure, and a past output cannot be reproduced. If you must re-check a draw later, record the range and generation time when you make it.

Common questions

Why can't I just use Math.random()?

Math.random() is not specified to be cryptographically secure, and browser implementations have had their outputs predicted or influenced by attackers. getRandomValues draws from the operating system's cryptographic random source, the same class used to generate TLS keys. For a lottery draw, a code, or anything a guesser must not anticipate, the source is the whole point.

How do I know the output is actually random?

You cannot verify a single draw, because a result you could double-check would be a predictable one. What is verifiable is the method: the documented Web Crypto source and the unbiased mapping technique. Run many draws and check the distribution if you want evidence - the counts per value should converge to uniform.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.