Random values in JavaScript

Math.random()

Math.random() returns a pseudorandom number at least zero and less than one. It suits simple simulations and visual effects, but is not cryptographically secure. Do not use it for session tokens, recovery codes or attacker-resistant decisions.

Integers in a range

Multiply by an exclusive upper limit and apply Math.floor. This selects an index in a nonempty array. Math.round would give differently sized intervals to the endpoints.

const options = ["HTML", "CSS", "JavaScript"];
const index = Math.floor(Math.random() * options.length);
console.log(options[index]);

Web Crypto

crypto.getRandomValues() fills an integer array with cryptographically secure values. Unlike randomUUID(), it can also run in an insecure context.

Example

The call modifies the supplied array. This obtains four 32-bit integers; it is not a complete password generator.

const values = new Uint32Array(4);
crypto.getRandomValues(values);

Distribution and bias

Secure generation does not make every transformation uniformly distributed. Using % when the target range does not divide the source range exactly can introduce bias. Sensitive draws or protocols need a reviewed generation, selection and verification process.

What to check

1. Run selection repeatedly; every result must belong to the list.
2. Check the exclusive upper limit and handle empty lists first.
3. Do not expect identical results or treat a small sample as statistical proof.