Random numbers: pseudo-random and true random

In short: Computers are deterministic, so they usually produce randomness with a calculation rule (pseudo-randomness). True randomness comes from physical sources such as noise, timing or radioactivity.

In more detail: A pseudo-random number generator (PRNG) starts with a start value (seed) and calculates a sequence from it that looks random but is completely predetermined. Whoever knows the seed and the algorithm can predict everything. That is enough for games and simulations but not for cryptography.

In detail

• PRNG: Mersenne Twister, Xorshift, PCG. Fast, well distributed, but predictable.
• CSPRNG: cryptographically secure generator (ChaCha20, AES-CTR, HMAC-DRBG). Not predictable even when earlier outputs are known, fed with real entropy.
• TRNG (true randomness): electrical noise, thermal noise, clock jitter, timing of key presses, special chip instructions (RDRAND on Intel/AMD).
• Operating system: Linux collects entropy and provides /dev/urandom and getrandom(), Windows BCryptGenRandom.
• Use: passwords, keys, session tokens, salts: always CSPRNG. Rolling dice in a game, shuffling cards: PRNG is enough.
• Mistake: using Math.random() for tokens is a known security flaw.
• Real-world example: Cloudflare and the lava lamps (LavaRand).

See also: Random values, Random and rounding in many programming languages