Methods and limitations
Randomchik does not use one universal algorithm. The method depends on the tool. This page distinguishes verified implementation details from limits that remain.
Integer selection and credentials
The shared integer sampler uses crypto.getRandomValues and rejection sampling: values outside the largest evenly divisible interval are discarded before taking the remainder. This avoids modulo bias. The sampler accepts safe integer bounds spanning no more than 2^32 values and fails if Web Crypto is unavailable.
The number tool includes both bounds, supports up to 100 results and a range of at most 1,000,000 values. Without-replacement mode samples from the eligible values after exclusions. An impossible request produces a settings error, not a partial list.
Tools in the security category do not fall back to server generation when browser generation fails. Generated results are not added to the shared history or social-sharing links. This does not protect against compromised extensions, clipboard readers or an infected device.
What this does not guarantee
Other tools and visual effects may use Math.random, predefined dictionaries or server implementations. Web Crypto use in one module does not certify the entire site. Dice and coin demonstrations are not audited gambling systems. The coin tool can intentionally change the probability in its bias setting.
The mnemonic generator uses a reduced dictionary without the BIP39 checksum and must not be used for cryptocurrency. Passphrase dictionaries are small and are not the full EFF Diceware list. Test OTP strings have no secret key, time step, server validation or automatic single-use property.
Reproducible checks
The public sampler and its Node.js test script check interval bounds, forced rejection, unavailable crypto and invalid arguments. A frequency experiment is only a diagnostic check, not proof of cryptographic security.
- random.js
- random-check.mjs (Node.js 20+,
node random-check.mjs)
Analytics and privacy
The measurement module sends only fixed event names, a public tool identifier and language to Yandex Metrica. It does not send form values or generated output. Session replay and click maps are disabled. Technical logs and error reports are separate processing channels; do not include passwords or other secrets in reports.
