Math.random vs Crypto Random: What Classroom RNGs Should Disclose
Reproducible demos are a feature; silent “security” claims are a bug
Math.random vs Crypto Random: What Classroom RNGs Should Disclose
Browser worksheets that say “random” without naming the generator teach the wrong lesson. Math.random is fine for dice demos. It is not fine for passwords. Seeded educational PRNGs are even more predictable by design—so a responsible tool discloses both the algorithm class and the security boundary.
When Math.random Is Enough
Sampling practice sets, shuffling ungraded examples, or simulating inclusive integer ranges for probability intuition does not face an adversary. Documenting Math.random (or a seeded mulberry32 draw) lets students reproduce or critique the sample.
When You Need Web Crypto
Anything an attacker would benefit from predicting—reset tokens, API keys, lottery-style fairness, session secrets—needs a CSPRNG such as crypto.getRandomValues. No classroom seed field belongs near that workflow.
See an educational RNG with a disclaimer
Generate inclusive draws and read the generator type in the result details:
Open Random Number GeneratorKey Takeaways
- Name the generator: Math.random, seeded PRNG, or CSPRNG
- Seeds buy reproducibility, not secrecy
- Inclusive ranges should state whether endpoints can appear
- Security-sensitive randomness belongs in Web Crypto—not a math worksheet