Randomness Explained: How Password and Number Generators Work

"Random" tools online range from casual (a dice roller for game night) to security-critical (a password generator protecting real accounts) — and the underlying randomness source matters a lot more for the latter.

Not all randomness is created equal

JavaScript's basic Math.random() is fast but not cryptographically secure — with enough samples, its internal pattern can theoretically be predicted. For anything security-sensitive, like password generation, browsers provide the Web Crypto API's crypto.getRandomValues(), which draws from the operating system's cryptographically secure random number source. A password generator worth trusting should be using the latter, not the former.

Why length beats complexity rules

A common misconception is that adding symbols and mixed case matters more than length. In reality, each additional character multiplies the total number of possible passwords, while each additional allowed character type only multiplies it by a small constant factor. A 16-character password using only lowercase letters (26 possibilities per character) has 26^16 ≈ 4.3 × 10^22 possible combinations — already far more than any brute-force attack could feasibly try — while an 8-character password using all four character types still has "only" roughly 94^8 ≈ 6 × 10^15 combinations, orders of magnitude fewer. Longer beats more complex.

UUIDs: astronomically unlikely collisions

A version 4 UUID (like "f47ac10b-58cc-4372-a567-0e02b2c3d479") packs 122 random bits into a standardized format. With 2^122 possible values — a number with 37 digits — the odds of two randomly generated UUIDs ever colliding are so small they're routinely ignored in database design, even at massive scale.

Dice, coins, and uniform distributions

A fair dice roll or coin flip needs a uniform distribution — every outcome equally likely. Generating a random integer between 1 and 6 by taking "Math.floor(Math.random() * 6) + 1" achieves this correctly, but naive implementations (especially ones using modulo on a non-power-of-two range) can introduce subtle bias toward certain numbers if not implemented carefully.

Lorem Ipsum: not random, just placeholder

Unlike everything else in this guide, Lorem Ipsum generators aren't actually random — they cycle through a fixed, well-known word bank derived from scrambled classical Latin text, used purely as visual filler so designers can evaluate a layout without being distracted by reading real content.

• The password generator uses the Web Crypto API described above for genuine security
• The random number generator, dice roller, and coin flip simulator cover uniform-distribution randomness for games and sampling
• The UUID generator and lorem ipsum generator round out the set for developer and design use cases