Understanding True Cryptographic Randomness
Not all random number generators are built the same. Basic JavaScript implementations frequently rely on Math.random(), which uses pseudo-random algorithms (such as xoshiro128** or v8's XorShift128+). While fast for basic UI transitions, these algorithms are deterministic, vulnerable to state reconstruction, and suffer from modulo bias when mapping floats to integers.
PRNG vs. Web Cryptography API Comparison
| Feature / Dimension | Standard Math.random() | Our Web Crypto RNG Engine |
|---|---|---|
| Entropy Source | Deterministic seed algorithm | Operating System Hardware Entropy (CSPRNG) |
| Distribution Uniformity | Prone to modulo bias on division | 100% Uniform via Rejection Sampling |
| Cryptographic Security | Insecure (predictable state) | Cryptographically Secure (CSPRNG) |
| Client-Side Execution | Yes | Yes (Zero Network Latency & Zero Tracking) |
| Batch Sampling Limits | Variable, manual loops | Optimized up to 10,000 numbers in <15ms |
Eliminating Modulo Bias
When mapping a 32-bit unsigned integer (range 0 to 4,294,967,295) into a target range (such as 1 to 6), using a simple modulo operator rand % 6 produces a bias because 4,294,967,296 is not evenly divisible by 6. Numbers from 0 to 3 would have a slightly higher chance of appearing than 4 or 5.
Our engine eliminates this defect through rejection sampling: any sampled integer exceeding the largest exact multiple of the range size is discarded, ensuring every output number has an exact, uniform mathematical probability.