Pseudo-Random vs True Random: What Teachers and Giveaway Hosts Need to Know
Pseudo-Random vs True Random: What Teachers and Giveaway Hosts Need to Know, Pseudo-random numbers are generated by an algorithm, while true random numbers come from a physical process that is impossible to predict. In practice, either method works for creating a classroom wheel.
However, a cryptographically secure pseudo-random number generator offers more security for a prize wheel than a true random number generator. Modern browsers offer both options, but using a true random number source does not add security to the process. The main issues tend to be human error during the execution of the script.
By Malik Aiesh Bahadur,
The three kinds, in one table
|
Type |
Where the numbers come from |
Predictable? |
Example |
|---|---|---|---|
|
Pseudo-random |
A fast formula that starts from a seed |
In principle yes, if you know the seed and formula |
The browser's Math.random function |
|
Cryptographically secure |
A formula built so nobody can predict the next output, seeded from unpredictable system events |
No, for any practical purpose |
The browser's crypto.getRandomValues function |
|
True random |
Physical noise, such as electrical or atmospheric noise, measured by hardware |
No |
Services such as Random.org, hardware chips |
The middle row is the one most guides skip, and it is the one that matters most for wheels.
What "pseudo" means
A pseudo-random generator is an algorithm that takes a starting number, seed, and produces a long stream of pseudo-random numbers. The same seed will always produce the same stream.
The following is an example of a “pseudo-random” number generator that you can try by hand. The algorithm is as follows: take the last number in the sequence, multiply it by 7, add 3, and then take the last two digits of the result.
We start with 10. The next number is (10 7) + 3 = 73. Then, (73 7) + 3 = 514 → 14, (14 7) + 3 = 101 → 01, and (01 7) + 3 = 10. The next number will again be 73, and the sequence will repeat itself: 10, 73, 14, 01, 10, 73, and so on.
Our simple generator produces a sequence of numbers that looks random for a short series. However, once the pattern repeats, we can predict the next number. Pseudo-random number generators use a much more complicated set of instructions and start with a much larger seed number, so the cycle is significantly longer – for example, 10^500 digits. Nevertheless, the seed and the algorithm are known, and the entire sequence can be predicted.
That is why, in theory, nobody can create truly random numbers. Only pseudo-random numbers can be created that appear random – unless the algorithm and the seed have been compromised somehow.
What "true random" means
True random numbers cannot be created by a formula, but have to be created from a physical source such as electrical noise in a circuit or atmospheric noise captured by a radio. Random.org is a popular website that offers this type of service. Some computer chips also have a physical source built into them.
The benefit of this approach is that there is no formula to be found. Its disadvantages are that it is slow, expensive and requires specialized hardware. Physical random number generators have their own tiny biases, making it necessary to further process the raw output.
The middle ground: cryptographically secure
This is where virtually all modern devices live. A cryptographically secure generator is still a formula, but one that even an observer who sees millions of its outputs will not be able to predict its next value. The initial state of such a formula is determined by unpredictable events in your computer, such as hardware-level noise and timing information.
These provide almost all the benefits of actual randomness, without requiring exotic hardware. Web browsers provide access to such a function through their crypto.getRandomValues method. The standard built-in Math.random function is another variant, though browser makers specifically advise against using it for any security or trust-related purposes, as its internal implementation details vary from one browser to another.
For the purposes of wheels, this is the ideal solution. It is fast, requires no special hardware and the output values are unpredictable.
Does it matter for a wheel?
It depends on what is at stake.
|
Situation |
Is a basic pseudo-random generator fine? |
What I would use |
|---|---|---|
|
Picking a student to answer a question |
Yes |
A secure generator anyway, since it costs nothing |
|
Deciding who goes first in a game |
Yes |
Any wheel |
|
A giveaway with a small prize |
Probably, but arguments are possible |
A secure generator, a recorded screen and written rules |
|
A giveaway with a valuable prize |
Not if anyone could dispute it |
A secure generator, written rules, a record, and a check of the rules where you live |
|
Cryptographic keys or passwords |
No |
Not a wheel. Use proper tools |
Note what is missing: nothing in this table needs hardware true randomness. A secure browser generator is more than enough for any draw you would run with a wheel.
What actually goes wrong
The type of your generator is rarely your problem. These are the things your users actually fight about.
Biased conversion. Conversion from a huge random number to the position on the list can have a tiny built-in preference if not done carefully. I explain why in how a spin wheel chooses a winner.
Hidden weights. Having some entries count more than others without consent of the participants makes the draw unfair, see weighted spin wheels.
Duplicate entries. Having the same name in the list twice gives it double chances.
Re-spinning. Spinning the wheel again after an undesirable outcome completely defeats the purpose of a draw.
Silent modifications. Adding or removing names from the list while it is active modify everyone's chances.
A host that does not follow rules. Most of the arguments I can think of would revolve around this issue.
Three myths about randomness
"Random means even." It doesn't. In a truly random system there will be streaks and clusters. If you have a wheel with ten names on it, and you spin it ten times, what are the odds that you'll get each name once? They're roughly 4 in 10,000. Which means that about 99.96% of the time, you'll get a repeat name. I look at the numbers behind the wheel stopping someone from getting the same winning numbers twice in a row.
"True random is better." To the wheel, no. A quality secure random number generator and a physical wheel of chance can't be distinguished from one another in any meaningful way. It's about the odds.
"I haven't won yet, so I'm bound to." The wheel doesn't remember, and every spin is independent. All those losing tickets? They don't affect the odds at all.
How to check what a wheel uses
Begin with the tool's own explanation. A decent tool will specify which generator it uses and provide a link to the proof. If it says nothing, consider that a warning.
At the same time, you can perform a test yourself, using the method how a spin wheel chooses a winner: launch thousands of spins and see if the distribution of the results meets your expectations. It won't tell you if everything is perfect, but it certainly highlights obvious issues. Most importantly, it can't reveal what goes on in the software's code. Our Randomness Audit describes in detail what Wheel Spiner does.
- When to Let a Yes or No Wheel Decide
- How to Stop a Spin Wheel Repeating Winners
- Weighted Spin Wheel Explained: How Weights Change Your Odds
- How to Split a Group Into Fair Teams: 3 Methods
- How to Make a Spin Wheel in 60 Seconds
- Pseudo-Random vs True Random: What Teachers and Giveaway Hosts Need to Know
What to tell your participants
If you're doing a giveaway/draw for a class, one sentence is sufficient. Something along the lines of the following: "The wheel picks using the secure random number generator implemented in the browser, so that everyone has equal odds, and I am recording the screen."
This conveys what you used, that the odds were fair, and that the draw can be verified.
Frequently asked questions
What is the difference between pseudo-random and true random?
The pseudo-random numbers are generated by a formula, and true random numbers are generated through the measurement of an unpredictable physical process.
Is a spin wheel pseudo-random or true random?
The digital wheel is a spin wheel whose outcome is determined by a computer generator. Wheel Spiner uses the browser’s cryptographically secure generator. It uses a formula, seeded with non-deterministic values, to produce the outcome of the wheel.
Is pseudo-random good enough for a giveaway?
Cryptographically secure pseudo-random number generators are good enough for giveaways. The regular pseudo-random number generator is good enough for regular games, but it is considered a bad practice when the outcome may be disputed.
Can a pseudo-random number be predicted?
In theory, yes, if you know the formula and the state of the generator. A cryptographically secure pseudo-random number generator is designed such that this is not possible.
Is Math.random safe for a prize draw?
No, it is not designed to be. Use a cryptographically secure random number generator instead.
Do I need hardware random numbers for a wheel?
Not at all, a cryptographically secure pseudo-random number generator is more than enough.
Try it
Spin the Spin Wheel with a list of ten names a few times and see how many times a name repeats. If you want to experiment with numbers, head to the Random Number Generator . Our next lesson is about a physical representation of probability: is a coin flip really 50/50?
