How crypto.getRandomValues() Works
crypto.getRandomValues() is a method from the Web Crypto API that generates cryptographically secure random numbers. Unlike Math.random(), it draws from entropy sources provided by the operating system, making it suitable for security-sensitive applications and everyday generators alike.
What is crypto.getRandomValues() and how does it work?
crypto.getRandomValues() is part of the Web Crypto API, which is built into modern browsers and Node.js. Unlike Math.random(), which uses a deterministic pseudorandom number generator (PRNG), crypto.getRandomValues() fills a typed array with cryptographically strong random values drawn from the operating system's entropy pool.
On most operating systems, this entropy is gathered from sources such as hardware interrupts, mouse movements, keyboard timings, and similar unpredictable events. Because the values are drawn from physical randomness rather than a fixed algorithm, they are much harder to predict or reproduce.
The method takes a typed array — such as Uint8Array, Uint16Array, or Uint32Array — and fills it with random values:
const array = new Uint32Array(1)
crypto.getRandomValues(array)
console.log(array[0]) // A cryptographically random 32-bit integer
Why crypto.getRandomValues() is stronger than Math.random()
The key difference comes down to predictability:
-
Math.random()uses a seeded algorithm. In principle, knowing the seed or enough output values allows the sequence to be predicted. Browsers do not expose the seed, but the underlying PRNG is not designed with security in mind. -
crypto.getRandomValues()draws from the system's entropy pool, which is continuously replenished with data from hardware events. Predicting its output without access to the hardware itself is computationally infeasible.
For applications such as generating tokens, identifiers, or anything where predictability must be avoided, crypto.getRandomValues() is the right choice. For games, animations, or visual variation where security is not a concern, Math.random() remains a perfectly valid option.
Read more about how Math.random() works and why we eventually moved on from it.
How Slumpgenerator uses crypto.getRandomValues()
Slumpgenerator was originally built using Math.random() to power its generators. While this works well for most purposes, it is not cryptographically secure — the values can in theory be predicted if the internal state of the PRNG is known.
We have since migrated all random number generation to use crypto.getRandomValues(). This gives every generator — from the number generator to the dice roller — a stronger foundation of randomness.
Internally, all generators use a shared helper function called cryptoRandom(), which wraps crypto.getRandomValues() and returns a floating-point number in the range [0, 1) — the same interface as Math.random(). This makes it easy to use as a drop-in replacement:
const cryptoRandom = () => {
if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
const array = new Uint32Array(1)
crypto.getRandomValues(array)
return array[0] / 2 ** 32
}
return Math.random()
}
By dividing the random 32-bit integer by 2^32 (4 294 967 296), we get a number in the range [0, 1), just like Math.random(). The fallback to Math.random() is included for environments where the Web Crypto API is not available, though this is extremely rare in modern browsers.
This cryptoRandom() function is then used to build higher-level utilities:
// Pick a random item from an array
const random = (array) => array[Math.floor(cryptoRandom() * array.length)]
// Generate a random integer in a range
const randomInRange = (min, max) =>
Math.floor(cryptoRandom() * (max - min + 1)) + min
Browser support and availability
crypto.getRandomValues() is supported in all modern browsers and has been available for many years. It is also available in Node.js (version 15+) as globalThis.crypto.getRandomValues().
Read more about the method on Mozilla's website MDN.