Is the coin toss fair?
A deep dive into how we guarantee a mathematically perfect 50/50 flip.
The Problem with Math.random()
Most simple online coin toss tools use the built-in JavaScript function Math.random(). While this is fine for a quick game, it is not considered cryptographically secure.
Math.random() relies on a pseudo-random number generator (PRNG) that is designed for speed, not absolute mathematical unpredictability. If an attacker observed enough outputs, they could theoretically predict the next sequence of numbers.
The Solution: Web Crypto API
At cointoss.uk, we use the modern Web Crypto API, specifically crypto.getRandomValues().
This method draws entropy (randomness) from the operating system itself—including hardware events like thermal noise or mouse movements. This ensures the output is cryptographically secure and genuinely unpredictable, guaranteeing a completely fair flip.
How We Process The Result
When you click the flip button, our script requests a single byte of random data from your operating system. A byte is a number between 0 and 255. We then use the modulo operator (% 2) to determine if the number is even or odd. Even numbers become Heads, and odd numbers become Tails.
const array = new Uint8Array(1);
crypto.getRandomValues(array);
const side = array[0] % 2; // 0 for Heads, 1 for TailsThis is the same level of randomness used to generate secure encryption keys for banking websites, making it millions of times fairer than tossing a real physical coin (which actually has a slight 50.8% bias depending on which side starts facing up!).