Entropy Explained
Every encryption key protecting your data, payments, and logins starts life as a random number. Entropy is the raw randomness those numbers come from. Get it wrong, and everything built on top inherits the weakness.
Updated 12 min read
The Short Answer
Entropy in cryptography is the measure of true, unpredictable randomness used to generate keys, tokens, and nonces. High entropy produces keys an attacker can't guess or reproduce. Low entropy produces predictable keys that can be recreated without ever breaking the encryption algorithm.
New to the terms? Browse the entropy glossary, or measure the entropy of any text with Cryptography Academy's entropy calculator.
The Stakes
Entropy matters because encryption is only as strong as the randomness it starts from. If an attacker can guess or reproduce the random values behind a key, they don't need to break the algorithm. They recreate the key.
That's what makes entropy failures dangerous: a key generated from weak entropy still works normally. Logins succeed, TLS handshakes complete, signatures verify. Nothing looks wrong. The key just also works for anyone who can predict it.
Passwords, TLS sessions, API tokens, signing certificates, and crypto wallets all start with a random number. If that number isn't actually random, the security on top of it isn't actually secure.
Two Kinds of Random
A pseudo-random number generator (PRNG) uses an algorithm to produce numbers that look random but are fully determined by a starting value called a seed. A true random number generator (TRNG) measures randomness from a physical process, so there's no seed to recover and no formula to reverse.
| Pseudo-random (PRNG) | True random (TRNG) | |
|---|---|---|
| Source | Software algorithm | Physical measurement |
| Needs a seed | Yes | No |
| Reproducible | Yes, with the seed and algorithm | No, not even by the vendor |
| Main weakness | Predictable if the seed is weak or exposed | Must be monitored for physical drift |
| Best for | Simulations, games, non-security shuffling | Key generation, signing, high-assurance crypto |
Most production systems use a cryptographically secure PRNG (CSPRNG) seeded from an entropy source. That design is sound, but it moves the whole question to the seed: a CSPRNG fed weak entropy produces weak output, fast. More on seeding in how RNG seeds work, and on the bigger question in can computers generate true random numbers.
Deterministic entropy is a computation: something to predict or replay. Physical entropy is a measurement. There's no seed to recover and no equation to reverse.
Real-World Vulnerability Stories
Weak entropy has broken real systems many times, and the pattern is always the same: the encryption algorithm worked, but the randomness behind the keys was predictable.
Netscape's early SSL implementation seeded its random number generator from the time of day and process IDs. Researchers Ian Goldberg and David Wagner showed the seed space was small enough to brute-force, recovering session keys in minutes or less.
Source: Goldberg and Wagner, "Randomness and the Netscape Browser," Dr. Dobb's Journal, January 1996A code change in Debian's OpenSSL package removed most of the entropy feeding its random number generator, leaving the process ID as the main variable. For about two years, SSH and SSL keys generated on Debian-based systems came from a tiny, enumerable set of possibilities. Every affected key had to be regenerated.
Source: Debian Security Advisory DSA-1571-1 (May 2008)Researchers scanned the public internet, collected millions of TLS and SSH keys, and found many devices had generated keys sharing prime factors. That let them compute the private keys for a measurable fraction of hosts. The root cause: embedded devices generating keys at first boot, before they'd collected enough entropy.
Source: Heninger et al., USENIX Security 2012Of 75 million RSA certificates analyzed, about 1 in 172 shared a prime factor with another key because of poor randomness, making them breakable.
Source: Keyfactor, "Factoring RSA Keys in the IoT Era" (2019)AMD Zen 5 processors could return zeros from the RDSEED instruction while signaling success.
Source: AMD Security Bulletin AMD-SB-7055A more recent case: weak key generation behind a large bitcoin theft.
Full breakdown in how weak entropy led to the LuBian bitcoin theftAttackers didn't break the math in any of these cases. They walked around it.
The conditions behind these failures still exist: virtual machines cloned from one snapshot, IoT devices with no keyboard or disk activity to draw from, and containers spun up by the thousand. See pseudorandom passwords on IoT devices for one example.
Raising the Stakes
Yes. Post-quantum cryptography (PQC) replaces algorithms that quantum computers could break, like RSA and elliptic curve cryptography, but every PQC algorithm still needs high-quality entropy to generate keys. A post-quantum key built from weak randomness is still a weak key.
In August 2024, NIST published its first three finalized post-quantum standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). Source: NIST announcement.
That milestone started the clock on migration, and “harvest now, decrypt later” is the reason it matters today: adversaries can collect encrypted data now and decrypt it once quantum capability arrives. Background reading: what post-quantum cryptography is and TRNGs in the post-quantum era.
Real Random doesn't compete with PQC. We supply the entropy foundation PQC depends on: encryption you can trust today, ready for post-quantum standards tomorrow.
For a worked example, see PQC migration for crypto assets.
Inside the Machine
A hardware random number generator measures an unpredictable physical process, converts the measurement into digital data, and conditions it into uniform random bits. Common sources include thermal noise, radioactive decay, and optical effects. Real Random measures something you can watch: dice tumbling in viscous fluid. Background reading: introduction to hardware RNGs.
Dice tumble nonstop in viscous fluid. Redundant chambers keep entropy flowing.
Every roll is visible to the cameras and to you.
Cameras capture each roll as raw pixel data. Analog in, digital out.
Stir timing is seeded with fresh entropy plus an external timestamp, so the motion can't be modeled.
Pixel data hashes into 256 or 512-bit values (about one per second), checked live by the DieHarder test suite.
Single-use values, deleted on draw, delivered in under 0.1 ms over TLS 1.3.
More on the thinking behind it: why the digital world needs physical entropy.
Integration
An entropy source sits underneath everything that generates keys: the operating system's entropy pool, crypto libraries, HSMs and key management systems, and your own applications. Real Random is licensed into your stack behind your firewall. You change the source, not the process.
Seeds /dev/random via rngd.
OpenSSL and wolfSSL integrations.
High-assurance seeds where keys are born.
APIs for whatever you build, also available as Entropy-as-a-Service.
Fallback: If the entropy feed is ever unreachable, your systems keep running on their native RNG. Nothing breaks.
Action Plan
You improve entropy by finding every place your systems generate keys, checking what feeds each one, measuring the quality, and adding a verifiable hardware source where it's weak. Here's the process, in order.
List every system that creates keys or tokens: servers, VMs and containers, HSMs, KMS, internal certificate authorities, IoT fleets, and application code that calls a random function directly.
For most Linux systems that's the kernel pool (/dev/random / getrandom()). Note anything seeded at first boot, cloned from a VM image, or running on embedded hardware with few unpredictable inputs. Those are the highest-risk spots.
Search for calls like Math.random(), rand(), or random.random() used for tokens, IDs, or secrets. Replace them with your platform's cryptographic API.
Test output with established suites (NIST Statistical Test Suite, DieHarder, ENT) and review your sources against NIST SP 800-90B, the standard for entropy source validation.
Feed a hardware TRNG into the OS pool, HSM, or KMS so every downstream consumer benefits without code changes.
Entropy quality can drift. Run health tests on live output and alert on failures, the same way you monitor uptime.
Not sure where you stand?
Take the Entropy ScorecardTrust, but Verify
Real Random produces entropy the same way the DICEMASTER did: physical dice suspended in viscous fluid, tumbling chaotically, captured by high-speed computer vision. The Brownian motion of the fluid, the collisions between dice, the rotation trajectories: these are extracted as multiple independent dimensions of entropy and combined into a continuous, verifiable output stream.
The result is not modeled randomness. It is not amplified noise. It is observable, physical, sovereign entropy, independently validated to prove it.
0.999996 bits per byte
Verified by Fourmilab ENT testing. The theoretical maximum is 1.0.
0.003001 serial correlation
Near zero, consistent with independent output bits. The ideal is 0.0.
NIST Test - Passed SP 800-22 Rev. 1a
NIST's statistical test suite for validating the randomness of RNG output used in cryptography.
Gartner® Cool Vendor in Data Security, 2025
Independently evaluated by Rochester Institute of Technology, with testing across the DieHarder, Fourmilab ENT, and NIST Statistical Test Suite. NIST SP 800-90B entropy source validation is in process at atsec.
Read the full test results (PDF)Gartner, Cool Vendors in Data Security 2025: Securing Your Data in the Age of GenAI and Quantum Computing, 25 August 2025. Gartner does not endorse any vendor, product or service depicted in its research publications. GARTNER is a registered trademark and service mark, and COOL VENDORS is a trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved.
Common Questions
Entropy in cryptography is the measure of true, unpredictable randomness used to generate keys, tokens, and nonces. The more entropy behind a key, the harder it is to guess or reproduce.
In cybersecurity, entropy refers to the randomness that protects secrets like passwords, session keys, and API tokens. Low entropy makes those secrets predictable, which lets attackers recreate them without breaking any encryption.
A TRNG measures randomness from a physical process, while a PRNG calculates numbers from an algorithm and a seed. PRNG output can be recreated if the seed is known; TRNG output can't. Deeper comparison: random vs. pseudorandom number generators.
Weak entropy produces predictable keys, so attackers can recreate private keys without breaking the algorithm. The Debian OpenSSL bug and the 2012 "Mining Your Ps and Qs" research both exposed real keys this way.
No. Software runs on deterministic hardware, so it can only collect randomness from outside events or physical sources. On VMs, containers, and embedded devices those events are often scarce, which is why hardware entropy sources exist.
No. PQC algorithms resist quantum attacks on the math, but they still need strong entropy to generate keys. Weak entropy undermines PQC just as it undermines RSA or ECC.
Start by mapping where keys are generated, then test output with suites like the NIST Statistical Test Suite, DieHarder, or ENT, and compare sources against NIST SP 800-90B. The Entropy Scorecard is a quick way to see where you stand.
Entropy-as-a-Service (EaaS) delivers true random data over a secure API, so applications can use hardware-grade entropy without installing hardware. More in what is Entropy-as-a-Service.
Yes. Rochester Institute of Technology independently evaluated Real Random's entropy source using NIST statistical test methodologies, and Fourmilab ENT testing measured 0.999996 bits per byte with a serial correlation of 0.003001. NIST SP 800-90B entropy source validation is in process at atsec. Full results: Real Random test results summary.
The system captures hashed pixel data from physical dice positions, not simple pip values. An entropy-fed feedback loop continuously varies pump speed and agitation patterns, and health tests validate output quality before concatenation and delivery. Because the entropy originates from a physical, non-deterministic process rather than a mathematical formula, there is no seed to reverse-engineer and no algorithm to model. This is what makes physical entropy fundamentally different from software-based alternatives.
Observability is one layer of trust. You can see that the physical process is genuinely chaotic, which is something no sealed hardware module or software algorithm can offer. But for regulated sectors, visual verification alone is not sufficient. Statistical testing and the ESV certification provide the formal, repeatable proof that auditors and compliance teams require. The two work together: you can see the source, and you can independently verify its output.
Get Started
Book a 20-minute walkthrough with a Real Random team member. Watch the dice tumble, see live test results, and talk through integration with your stack: OpenSSL, wolfSSL, HSM, KMS, or a custom API.
Want to keep reading? Browse more resources.
