QRNG in plain language

Almost every digital secret you rely on starts life as a random number. Your banking session, the certificate behind the padlock in your browser, the key inside a passport chip, the code that lets a car door recognise its own key fob: each one begins with a device picking numbers that nobody else should be able to guess.

This guide explains what "random" means in that sentence, why ordinary computers are surprisingly bad at it, and what a quantum random number generator (QRNG) adds.

What randomness actually means here

In everyday speech, "random" means messy or unexpected. In security it means something much stricter: nobody can do better than guessing. If an attacker who knows the design of your system, the time of day, the software version and every number you produced yesterday still cannot predict your next number better than a coin flip, that number is random enough to build a secret on.

Notice what this definition is not about. It is not about the numbers looking irregular. A sequence can look perfectly scrambled and still be entirely reproducible by someone who knows how it was made.

Why ordinary computers struggle

A computer is a machine built to be predictable. Give it the same input twice and it must produce the same output twice, otherwise nothing would ever work.

So when software needs random numbers, it uses a formula called a pseudo-random number generator (PRNG). The formula takes a starting value, the seed, and stretches it into a long stream of numbers that pass every statistical test for randomness you can throw at them.

The catch is in the name: pseudo. The stream is a deterministic function of the seed. Learn the seed and you can replay every number the system will ever produce — past, present and future. This is not a theoretical worry: weak or guessable seeds are one of the most reliable ways real systems get broken.

Modern operating systems improve matters by collecting unpredictable-looking events — key press timings, network jitter, interrupt timings — and mixing them into the seed. That works well on a busy laptop. It works far less well on a small device that boots into a known state, has no keyboard, no user, and needs a key within milliseconds of powering on.

Where a QRNG is different

A QRNG does not compute randomness. It measures it.

Quantum physics describes events whose outcome is not merely unknown but undetermined until the measurement happens. There is no hidden bookkeeping to read, no seed to steal, no state to reconstruct. Build a device that measures such an event and turn the result into bits, and you have numbers whose unpredictability rests on physics rather than on the secrecy of a starting value.

That is the whole idea. Everything else — the electronics, the tests, the certification work — exists to make sure the measurement is genuine and stays genuine.

What a real device does around the measurement

A QRNG is never just a sensor wired to an output pin. A trustworthy design does four things:

1. Measures the physical process and produces raw samples.
2. Health-checks those samples continuously, so a broken or degraded source is detected rather than silently producing rubbish.
3. Conditions the raw output — raw physical signals are usually biased or correlated, so they are compressed into fewer, uniform bits.
4. Documents how much unpredictability the source actually provides, so an evaluator can check the claim instead of taking it on trust.

The fourth point separates a serious product from a curiosity. A number stream that passes statistical tests proves only that no obvious pattern was found. An entropy model explains where the unpredictability comes from and how much of it there is.

Five myths worth dropping

• "Quantum random numbers are more random." Randomness is not a spectrum with a quantum tier at the top. The claim is about the reason the numbers cannot be predicted, not about a better grade of scrambling.
• "If it passes NIST tests, it is proven random." Statistical test suites detect structure. They cannot prove the absence of a shortcut only the designer knows about.
• "Hashing fixes weak randomness." Hashing spreads bits around; it cannot create unpredictability that was never there. Sixty bits of real entropy hashed into a 256-bit key is still a sixty-bit secret.
• "My cloud provider handles this." Somebody handles it — but if you ship devices, generate keys at manufacture, or run your own hardware, that somebody is you.
• "A QRNG encrypts things." It does not. It supplies the raw material that encryption, signatures and key exchange consume.

Where to go next

If you want the comparison in detail, read QRNG vs everything else. If you want to know what a QRNG will not do for you, read what a QRNG is not. And if you want the practical side — where these devices end up in real systems — read what you can do with a QRNG.