🎲 Random Number Generator

🔧 Mode

📝 Range

🆔 UUID version

v4 is 122 random bits per RFC 9562. v7 packs a 48-bit Unix-ms prefix with 74 random bits and stays monotonic inside a batch.

📝 {{ mode === 'hex' ? 'Hex character length' : 'Byte length' }}

1 ≤ length ≤ 1,024. Hex length counts characters (each byte is two hex chars). Bytes length is the raw byte count before base64 encoding.

📊 How many

1 ≤ count ≤ 1,000.

🔁 Seed (optional)

⚠️ When a seed is set, output is deterministic for reproducibility via xoshiro128**. This is NOT cryptographically secure — never use seeded output for tokens, salts, keys, IVs, or nonces.

📤 Output ({{ resultsCount }} values)

⚠️

ℹ️ About Random Number Generator

Cryptographically secure random number generator

This tool produces uniformly distributed random values for integers, floats, booleans, UUIDs (versions 4 and 7), hex strings, and arbitrary bytes encoded as base64. The default randomness source is your platform's CSPRNG — the RFC 4086-grade generator exposed through Web Crypto's crypto.getRandomValues in browsers and Node.js webcrypto on the server. The page never falls back to Math.random, which is explicitly disallowed for security or selection-fairness use cases by the ECMAScript specification.

Use the CSPRNG-backed modes for tokens, salts, nonces, password material, session identifiers, game RNG fairness, lottery draws, sampling without bias, and any other situation where output must be impossible to predict from prior values.

Modes and bounds

  • Integer — uniform integers in [min, max] (or [min, max) when "inclusive" is off). Up to 1,000 values per request. Uses rejection sampling against a power-of-two mask so the result is free of modulo bias.
  • Float — uniform doubles in [min, max) by default (exclusive of max); enable "inclusive" to reach exactly max. Up to 1,000 values per request.
  • Boolean — fair coin flips packed one bit at a time from the CSPRNG output. Up to 1,000 values per request.
  • UUID v4 — 122 random bits with the version and variant nibbles set per RFC 9562. Up to 1,000 per request.
  • UUID v7 — 48-bit Unix-millisecond prefix plus 74 random bits, monotonically non-decreasing inside a batch. Useful for database keys where lexicographic order should approximate creation order.
  • Hex — random hexadecimal strings of any length between 1 and 1,024 characters.
  • Bytes — random byte sequences of any length between 1 and 1,024 bytes, returned as base64.

CSPRNG mode — cryptographically secure

  • Security status: Secure for cryptographic use.
  • Source: crypto.getRandomValues (browser) and Node's webcrypto.getRandomValues (server). Both delegate to the platform CSPRNG seeded from kernel entropy.
  • Bias: Integer output uses rejection sampling against a power-of-two mask, so the distribution is uniform regardless of how (max - min + 1) divides 2^32. Naïve min + (rnd % range) generators carry modulo bias and are not used here.
  • Recommended use: Session tokens, CSRF tokens, password salts, API keys, encryption IVs, lottery draws, statistical sampling, fairness audits, anything where an attacker must not be able to predict the next value from prior values.
  • Standards: RFC 4086 (Randomness Requirements for Security) and NIST SP 800-90A.

Seeded mode — deterministic but NOT cryptographically secure

  • Security status: NOT secure. Seeded output is suitable for reproducibility only — fixtures, deterministic simulations, regression tests, and stateless examples.
  • Algorithm: The seed string is hashed into a 128-bit state with a four-lane MurmurHash3-style finaliser, then expanded through xoshiro128** (Blackman & Vigna). Period 2128−1.
  • Synchronous on purpose: xoshiro is pure JS so it works in both the browser and Node without async crypto.subtle.digest — the PHP Node bridge runs logic functions synchronously.
  • Same seed = same output across CSPRNG bypass for integer, float, boolean, hex, bytes, and UUID v4 (UUID v7 timestamps still come from Date.now).
  • Never use a seeded result for keys, salts, tokens, nonces, IVs, or anything an attacker should not be able to reproduce. xoshiro128** has not been designed to resist cryptanalysis; the state is recoverable from a few outputs.

Examples

  • Roll 10 dice: integer mode, min=1, max=6, count=10, inclusive on.
  • Sample a coordinate: float mode, min=-1, max=1, count=1 for a value in [-1, 1).
  • Random database keys: UUID mode, v7, count=100 for time-ordered identifiers.
  • Token material: hex mode, length=64 for a 256-bit token, or bytes mode length=32 for the same entropy as base64.
  • Reproducible test fixtures: integer mode with a seed string — the same seed always yields the same sequence.

API Usage Example:

POST /api/tools/math/random-number-generator
Content-Type: application/json

{
    "operation": "integer",
    "min": 0,
    "max": 100,
    "count": 10,
    "inclusive": true
}
Ready