Anything security-sensitive in the browser — session tokens, nonces, key material — should come from crypto.getRandomValues, the Web Crypto CSPRNG. This tool gives you a fast, visible confirmation that the source exists and produces well-distributed output in the exact browser and environment you are testing.
How it works
When you run the test the tool draws the requested number of bytes from crypto.getRandomValues and tallies how often each of the 256 possible byte values appears. From those counts it computes the Shannon entropy:
H = -Σ p(x) · log2 p(x)where p(x) is the observed probability of byte value x. A perfectly uniform distribution maximises this sum at 8.0 bits per byte. The tool flags a pass when the measured entropy exceeds 7.9, which a genuine CSPRNG clears easily on a reasonable sample.
As a second check it reports the minimum and maximum bin counts and a chi-square statistic comparing the observed counts against the uniform expectation of n / 256 per value. A chi-square near 255 (the degrees of freedom) is normal; a very large value would indicate a non-uniform source.
Notes and limitations
- A passing distribution does not prove cryptographic security on its own — a counter can look uniform too. The real guarantee comes from using
crypto.getRandomValues, whose presence this tool verifies. - Larger sample sizes produce a more stable entropy estimate; very small samples naturally score lower.
- Everything runs locally. The random bytes are never sent anywhere.