Pseudo-random: algorithm plus seed
Almost every 'random' number a computer generates by default is pseudo-random: a deterministic algorithm advancing from an initial value called a seed. The classic is a linear congruential generator. The catch: if you know the algorithm and the seed, the entire sequence is predictable. Many `rand()` functions seed from the system clock, so two runs a second apart are nearly guessable.
True random: physical noise
True randomness comes from unpredictable physical processes — thermal noise in a circuit, radioactive decay, tiny variations in mouse movement. Linux's `/dev/random` and CPU instructions like RDRAND draw entropy from hardware. This is unpredictable and non-reproducible, which is exactly what cryptography needs.
Why security can't use ordinary random
If you generate a password or key with `Math.random()`, an attacker who knows your language, version, and roughly when you ran it can narrow the search space dramatically. That is why a password generator must use a CSPRNG — a cryptographically secure generator built on a true-random seed. For games, giveaways, and simulations, the random number generator is perfectly fine; for keys, tokens, and verification codes, only CSPRNG qualifies.
A subtle trap: shuffling
Beginners often shuffle by 'pick a random element for each position,' which produces biased permutations — some orders appear more often. The correct method (Fisher–Yates) picks uniformly from the remaining elements, giving every order equal probability. Details like this are what make a shuffle fair.
The bottom line
Random is not 'looks messy' — it is about predictability. Use ordinary random for fun and stats; demand cryptographically secure random for anything that protects value or identity. The difference is the whole reason dedicated password tools exist.