Are Online Random Pickers Fair? How Randomness Works
Dice rollers, name pickers, raffle wheels and lottery number generators all promise a fair draw, and most people judge that promise by whether the results look random. That is a poor test: genuine randomness produces streaks, repeats and clusters that feel rigged, while a few common programming shortcuts produce results that look fine but are measurably biased. This guide explains where the randomness comes from, the mistakes that skew it, and how to tell the difference.
Where the randomness comes from
Browsers offer two sources. Math.random() is a fast pseudorandom generator: a formula that produces a sequence which passes statistical tests but could in principle be predicted by someone who learns its internal state. It is fine for games, simulations and classroom demonstrations. crypto.getRandomValues() draws from the operating system's cryptographically secure generator, which is seeded from unpredictable hardware events and is designed so that past outputs reveal nothing about future ones.
For anything where someone gains from the outcome, such as a prize draw, a seating or task assignment people care about, or a password, the cryptographic source is the right choice. Neither source needs an internet connection, and neither is made more random by clicking more times or waiting longer before pressing the button.
Modulo bias: the most common hidden flaw
Random generators produce numbers in a fixed range, such as 0 to 255 for a byte, and a tool has to squeeze that into the range it needs, such as 1 to 6 for a die. The obvious method, taking the remainder after dividing by 6, is subtly unfair: 256 is not a multiple of 6, so the remainders 0 to 3 occur 43 times each and 4 and 5 only 42 times. Those faces come up about 2.4% more often.
The fix is rejection sampling: throw away the few values at the top of the range that would cause the imbalance and draw again. It costs almost nothing and makes every outcome exactly equally likely. The same care applies to choosing a winner from a list of names, which is the same problem with a different range.
Shuffling and ladders can be biased too
Shuffling a list looks easy, but several intuitive methods are not uniform. Sorting by a random comparison, or swapping each item with any position in the whole list, makes some orders more likely than others. The standard Fisher–Yates shuffle, which swaps each item only with one at or after its own position, gives every order exactly the same chance.
Ladder games (ghost leg) have the same problem in visual form. A ladder with a handful of randomly placed rungs keeps most people close to where they started, so the outcome is far from fair even though it looks random. A fair version decides the assignment with an unbiased shuffle first and then draws a ladder that produces it.
Streaks and repeats are normal
People expect random results to alternate more than they do. In 100 fair coin flips, the chance of at least one run of six or more identical results is about 81%, and a run of seven or more still happens more than half the time. A picker that chooses the same name twice in a row, or a die that shows three sixes in a row, is not evidence of bias by itself.
Coincidences are also more common than intuition suggests. In a group of just 23 people, the chance that two share a birthday is about 51%. Each draw is independent of the last, so a number that has not appeared for a while is not "due"; believing it is the gambler's fallacy. Only a large number of draws can reveal a real bias, and even then the deviation has to be larger than chance alone would produce.
What lottery numbers can and cannot do
Choosing 6 numbers from 45 gives 8,145,060 possible combinations, and from 49 gives 13,983,816. Every combination has exactly the same chance, so a generator cannot improve your odds, and neither can birthdays, patterns or numbers that "have not come up lately". The one thing a choice can change is how many people you might share a prize with: popular patterns and dates under 32 are picked by many people.
A random generator is therefore useful for avoiding commonly chosen combinations, not for winning more often. For any real prize draw, use a cryptographically secure source, record how the draw was made, and, where possible, let participants see or repeat the process.
- Use crypto.getRandomValues() for anything with something at stake
- Check that a tool avoids modulo bias with rejection sampling
- Shuffle with Fisher–Yates, not a random sort
- Expect streaks and repeats in genuine randomness
- Judge bias only from many draws, not a few surprising ones
- No generator or pattern changes lottery odds