Entropy & Random / Random Generation

What you will do: Generate random bytes from Web Crypto, OpenSSL WASM, Math.random() and a linear congruential generator, and run the same statistical tests on each.

Worked example: Generate from the LCG source, then predict its next output from its internal state after generation — the prediction matches even though the LCG usually lands within range on the visual checks.

Runtime and privacy: The cryptographic exercise runs in this browser. Review the site privacy terms before entering sensitive material; use synthetic inputs for learning and evaluation.

Browse all Crypto Lab tools · Learn with Entropy & Randomness

For your role

Developer / Engineer

Generate from Web Crypto API and from Math.random() side by side: the first is the call your code should make for keys and nonces, the second is the one that must never be, and the panels show why.

Security Architect

The Production Entropy Sources section lists entropy-source products and, where one exists, the CMVP Entropy Validation Certificate that covers them (listed versions only); checking that evidence is where a key-generation design has to start.

Researcher / Academic

Generate 64 bytes from each source, Web Crypto API, OpenSSL WASM, Math.random() and Timestamp LCG, and compare them: the LCG output can be predicted from earlier bytes, yet it usually lands within range on the visual checks — a failure no output check shows.

Certification & Validation Engineer

The Production Entropy Sources section lists entropy-source products with the CMVP Entropy Validation Certificate that covers them, where one exists — read the version on the certificate before assuming it covers the part in your module.

IT Ops / DevOps

Use the four sources to see what a weak generator produces; the Production Entropy Sources list names the hardware and cloud entropy feeds to check for on your key-generating hosts.