Random Number Generation in C: rand(), srand(), Seeding, and Why It Is Not Cryptographic

0s7 min★ 30 XP

Lesson 107Mixed lesson

Random Number Generation in C: rand(), srand(), Seeding, and Why It Is Not Cryptographic

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format12 sections1 video4 code blocks1 practice itemUpdated Aug 27, 2026

rand generates a pseudo-random integer between 0 and RAND_MAX. It is deterministic. Given the same seed, it produces the same sequence every time. srand sets the seed. If you do not call srand, the default seed is 1, and your program produces the same "random" numbers on every run. The standard rand is not suitable for cryptography, simulations requiring statistical quality, or anything where predictability is a risk. It is fine for games, shuffling, and simple sampling.

Random Number Generation

#Seeding and Generating#link

#include <stdio.h>
#include <stdlib.h>
#include <time.h>

int main(void) {
    printf("Unseeded (always same):\n");
    for (int i = 0; i < 5; i++) {
        printf("  %d\n", rand());
    }

    srand((unsigned int)time(NULL));

    printf("\nSeeded with time:\n");
    for (int i = 0; i < 5; i++) {
        printf("  %d\n", rand());
    }

    printf("\nRAND_MAX = %d\n", RAND_MAX);

    return 0;
}

Run rand_demo

root@vulnarex:~#gcc -Wall rand_demo.c -o rand_demo && ./rand_demo

#Generating a Number in a Range#link

#include <stdio.h>
#include <stdlib.h>
#include <time.h>

int rand_range(int min, int max) {
    return min + rand() % (max - min + 1);
}

int main(void) {
    srand((unsigned int)time(NULL));

    printf("Dice rolls: ");
    for (int i = 0; i < 10; i++) {
        printf("%d ", rand_range(1, 6));
    }
    printf("\n");

    return 0;
}

Run rand_range_demo

root@vulnarex:~#gcc -Wall rand_range_demo.c -o rand_range_demo && ./rand_range_demo

The modulo approach has a slight bias when RAND_MAX + 1 is not evenly divisible by the range size. For a six-sided die with RAND_MAX of 2147483647, the bias is negligible. For cryptographic or simulation work, it matters. The proper fix is rejection sampling: discard values above the largest multiple of the range that fits in RAND_MAX.

STRICT SECURE AUDIT RULE

Never use rand() for security-sensitive purposes: session tokens, password salts, cryptographic keys, nonces. The output is predictable. An attacker who observes a few values can reconstruct the internal state and predict all future values. Use /dev/urandom on POSIX, BCryptGenRandom on Windows, or a vetted library like libsodium.

★ 30 XP

quiz BLOCK (★ 30 XP)

What happens if you call rand() without calling srand() first?

Select your proof vectors above

rand is a teaching tool and a game utility. It is not a security primitive. Know its limitations. Seed it deliberately. Use it for shuffling and sampling. Use /dev/urandom for anything an attacker might care about. Next: memccpy, a bounded copy that stops at a delimiter byte.

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 30 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

Seeding and Generating Generating a Number in a Range

Content

Last updated

August 27, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "https://vulnarex.com/api/content/lessons?courseSlug=c-programming-tutorials&lessonSlug=107-random-number-generation&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.

#include <stdio.h>

#include <stdlib.h>

#include <time.h>

int main(void) {

printf("Unseeded (always same):\n");

for (int i = 0; i < 5; i++) {

printf(" %d\n", rand());

}

srand((unsigned int)time(NULL));

printf("\nSeeded with time:\n");

for (int i = 0; i < 5; i++) {

printf(" %d\n", rand());

}

printf("\nRAND_MAX = %d\n", RAND_MAX);

return 0;

}

#include <stdio.h>

#include <stdlib.h>

#include <time.h>

int rand_range(int min, int max) {

return min + rand() % (max - min + 1);

}

int main(void) {

srand((unsigned int)time(NULL));

printf("Dice rolls: ");

for (int i = 0; i < 10; i++) {

printf("%d ", rand_range(1, 6));

}

printf("\n");

return 0;

}