superandom
Randomness harvested from the person using the page, folded with the platform CSPRNG, with a receipt anyone can verify. One script tag, no dependencies, and zero network calls.
Source on GitHub · superandom on npm · MIT · 33.1 KiB minified
Move your mouse
collectingThe counter below is the SDK's own estimate of how much secret entropy your input has contributed. It is deliberately stingy: a pointer move claims two bits however far it travels, because a mouse path is a smooth curve and most of it is predictable.
What comes out
Live output, one pixel per bit, repainting a few times a second. Next to it, how often each of the 256 byte values has come up, drawn as deviation from perfectly uniform. Raw counts would be a solid block, since they sit within a fraction of a percent of each other. The wobble around the line is the part worth looking at, and it should stay small and shapeless.
65,536 bits
byte frequency, deviation from uniform
Try it
randomInt(1, 7)
Where it came from
Every source, its cap, and why the cap is what it is. A source whose health tests trip stops earning credit entirely: that is what catches a stuck sensor or a replayed path.
| Source | Events | Bits | Cap | State | Why that cap |
|---|
Is it actually random
A subset of the NIST SP 800-22 battery, run in this tab over 64 KiB of fresh output. A p-value below 0.001 fails. A correct generator fails one test in a thousand by chance, so an occasional red is expected and a consistently red row is not.
The receipt
A hash chain over public metadata: how many reseeds, which sources contributed, whether they were healthy, and when. It commits to no secret, so it is safe to publish. Verifying it recomputes the chain from scratch.
Use it
<script src="https://nader.io/pkg/superandom/superandom-1.0.1.js"
integrity="sha384-KHbMCgMbr9rYArINMOMDvBL1wU5njaZGuhFK99Sg/RHnSkXVxmks5btzVHsFoPgH"></script>
<script>
superandom.randomInt(1, 7);
</script>
Or npm install superandom. The version in that URL is pinned and the integrity
hash matches this exact build, so the browser refuses the file if a single byte changes.
Generation throughput, measured live in this tab: measuring.
What "true random" means here
This is not more random than crypto.getRandomValues(). The
platform generator is seeded from OS entropy and is cryptographically sound. Anyone telling
you their mouse-wiggle library beats it is selling something.
What superandom adds is an independent physical source, an auditable process, and a posture
where a backdoored or badly-seeded platform generator stops being fatal. Every byte it hands
out is XOR-folded with an independent, freshly drawn platform mask. For any value independent
of a uniform one, the XOR is uniform. So if the entropy pool is empty, the estimate is wrong,
or this library has a bug, output is still exactly as good as
crypto.getRandomValues(). And if the platform generator is the broken one, output
is still as good as the DRBG. Both have to fail before you lose anything.
It started out planning to mix in Bitcoin blocks, weather and planetary positions. All of it
was cut, and the reason generalises: entropy is measured against what an attacker knows. A
value published to the world is not secret from anyone, so a public feed adds exactly zero
secret bits however chaotic its origin. Planetary positions are a deterministic function of
the clock, and the attacker has the same clock. Dropping them made this better rather than
thinner: no third-party requests, no consent question, works offline, and nothing ever leaves
your browser. The build fails if the bundle so much as mentions fetch.
Your keystroke content is never read, only the interval between events. Canvas pixels are never read either, because a canvas hash is a stable fingerprint: zero entropy and a precise tracking identifier. Nothing is written to storage.
This is unaudited cryptographic code. The fold means the realistic worst case is that you get
exactly crypto.getRandomValues(), which is the point of the design, but do not
treat "unaudited" as a formality.