Random Data Generator

Two kinds of random, used for different things

A pseudorandom generator produces a deterministic sequence from a seed. It is fast, statistically well-distributed, and entirely predictable to anyone who learns the state — which a handful of outputs is often enough to recover. A cryptographically secure generator draws on operating system entropy and is designed so past output reveals nothing about future output. Simulations, sampling, shuffling a playlist and test data want the first. Tokens, keys, passwords and anything an attacker benefits from predicting require the second, and the failure is silent when the wrong one is used.

Range bias is easy to introduce

Taking a random number modulo a range skews the result unless the range divides the generator's period evenly. With small ranges the bias is negligible; with large ones it is measurable, and in a security context it narrows the search space. Rejection sampling — discarding values in the unusable tail and drawing again — removes it, and most standard libraries now expose a correct range function that does this internally.

Shuffling has one correct algorithm

Fisher-Yates produces a uniform permutation in linear time. Sorting with a random comparator, the common shortcut, does not: it produces a biased distribution and, in some engines, undefined behaviour because the comparator is inconsistent. This appears constantly in code that shuffles quiz questions or randomises a list, and the bias is invisible without testing for it.

Seeds make randomness reproducible

A fixed seed produces the same sequence every run, which is exactly what testing, simulation and debugging need — a failure that cannot be reproduced cannot be investigated. Never seed a security-relevant generator, and never seed with the current time, since the value is guessable within a narrow window and this has broken real systems.

Human intuition about randomness is poor

People reject genuine random sequences for containing runs and clusters, which random data reliably produces. In 20 coin flips a run of four is likely. Streaming services deliberately de-randomise shuffle because true random feels broken to listeners. If output looks suspiciously clumpy, that is usually evidence it is working.

Uniform is not the only distribution

Uniform random suits dice and selection. Real-world quantities rarely are: response times are long-tailed, natural measurements are roughly normal, and file sizes and city populations follow power laws. Test data drawn uniformly misses precisely the extremes that cause production failures.