How to Generate Unbiased Random Numbers, Dice, and Decisions

Separate randomness from range mapping

Math.random is not intended for cryptographic secrets. Its algorithm and state-recovery properties vary by implementation, so a universal claim that two outputs reveal every state is unjustified. Web Crypto supplies cryptographically strong pseudorandom values seeded through the browser implementation, not a promise of direct hardware readings on every call.

A 32-bit unsigned word has 2^32 possible values. Mapping every word with remainder modulo six would favor some die faces because six does not divide that count. Rejection sampling discards the incomplete upper bucket before applying the remainder.

Work through a six-face draw

For six faces, accept words below 4,294,967,292 and redraw the final four values. Each remainder then has the same number of accepted source words. The illustrative function below validates a one-word range; it is not a replacement for a public lottery protocol.

Two independently drawn six-sided dice have sums with different probabilities: seven has six ordered combinations, while two has one. Uniform individual faces do not imply uniform totals.

function uniformBelow(limit) {
  const space = 2 ** 32;
  if (!Number.isInteger(limit) || limit < 1 || limit > space) {
    throw new RangeError("Expected an integer range from 1 to 2^32");
  }
  const cutoff = Math.floor(space / limit) * limit;
  const word = new Uint32Array(1);
  do { crypto.getRandomValues(word); } while (word[0] >= cutoff);
  return word[0] % limit;
}
// A die face is 1 + uniformBelow(6).

Choose a process that fits the stakes

Check the actual tool’s supported bounds before drawing; the random-number workspace limits its inclusive span to one billion. Generation runs locally, but a result screenshot does not prove that the operator did not reroll, alter the page or choose which result to publish.

Use a documented auditable process when other parties must verify the draw. Do not interpret cryptographic pseudorandomness as a guarantee of application integrity, legal eligibility, browser privacy or a balanced outcome in a short sample.

References

Use the linked specifications and product documentation to check behavior in your own environment.