"Quantum" is one of the most overloaded words in security. Several genuinely different technologies share it, and vendors, journalists and procurement documents mix them up constantly. This guide draws the boundaries, because knowing what a QRNG is not is often more useful than another definition of what it is.
Not encryption
A QRNG produces numbers. It does not protect anything by itself.
Encryption algorithms, digital signatures and key-exchange protocols consume random numbers as an input. A QRNG improves the quality of that input. Swap in the best entropy source in the world and a system with a broken protocol, a hard-coded key or an unpatched library is exactly as broken as before.
Not a quantum computer
A quantum computer is a machine that runs computations on quantum states, and the reason people worry about it in security is that a sufficiently large one would break today's public-key cryptography.
A QRNG uses quantum behaviour for one narrow job: producing unpredictable outcomes. It solves no computational problem, runs no algorithm, needs no error correction, and does not require a cryogenic laboratory. The two share a branch of physics and nothing else.
Not quantum key distribution
Quantum key distribution (QKD) is a way for two parties to agree on a shared key over a quantum channel, typically optical fibre, in a way that reveals eavesdropping. It is a communication technology with its own infrastructure requirements and its own debate about where it belongs.
A QRNG is a component inside one device. It generates local randomness; it does not distribute anything, and it needs no dedicated link between sites. QKD systems in fact need good random number generation themselves — the two are complementary, not alternatives.
Not "quantum-safe" on its own
Post-quantum cryptography (PQC) is about replacing algorithms that a future quantum computer could break. That is an algorithm migration, and a QRNG does not perform it.
The honest relationship is narrower and still important: every PQC scheme generates keys and other secret values from random input. A migration to quantum-resistant algorithms that keeps a weak entropy source underneath has moved the risk, not removed it. A QRNG strengthens the foundation the new algorithms stand on. It does not replace them.
Not a website that gives out random numbers
Several services will hand you random numbers over an API, some of them backed by real quantum hardware. They are useful for demonstrations, research and simulations.
They are not a substitute for local entropy in a security product. Numbers that arrive over a network have been seen by the generator, by whatever sits between you and it, and possibly by log files along the way. Secret material should be generated where it is used.
Not proven good because it passes statistical tests
Test suites such as NIST SP 800-22 or Dieharder look for detectable structure in an output stream. Passing them means no listed pattern was found. It does not mean the output is unpredictable — a well-chosen formula with a known seed passes these suites comfortably while being perfectly reproducible.
Evidence about a real generator looks different: a documented entropy source, a model of how much min-entropy it provides, continuous health tests that catch degradation in service, and independent evaluation against frameworks such as NIST SP 800-90B or BSI AIS 31.
Not a replacement for key management
Even flawless randomness is undone by ordinary operational mistakes: keys copied into logs, secrets shared between devices, private keys exported to a laptop, no rotation, no revocation. Entropy is one link in the chain. It happens to be the link that cannot be repaired after the fact — a secret generated weakly stays weak forever, even after the bug that produced it is patched — which is exactly why it deserves attention early.
A checklist for evaluating any quantum claim
When you read a claim about quantum randomness, ask:
- What physical process is measured, and what is the evidence it is genuine?
- How much entropy is claimed, and against which model?
- What happens when the source degrades — is it detected, and how?
- Was the design evaluated by anyone other than the vendor?
- Which part of my system actually consumes these numbers?
Any product worth considering can answer all five. For how those answers should look, continue with what makes a QRNG trustworthy.