Gaussian random numbers
Normally distributed numbers from a cryptographic source — and the hard ceiling at 8.5717 standard deviations that the method cannot get past, however many you draw. Nothing you type here leaves your browser — it is worked out on your own device, so there is nothing to send and nothing to log.
This page will not fall back to Math.random(). Everything here is drawn from crypto.getRandomValues(), which the browser backs with the operating system's cryptographic source. If that is unavailable the page says so and produces nothing — because output from a weak source looks exactly like output from a strong one, and that is the whole problem.
This generator cannot reach the far tail. Ever.
The Box-Muller transform turns two uniform numbers into a normal one:
z = √(−2 ln u₁) × cos(2π u₂)
The size of z is governed entirely by how small u₁ can get. A double-precision uniform is a multiple of 2−53, so the smallest non-zero value it can take is about 1.11 × 10−16. Put that in:
√(−2 ln 2−53) = 8.5717
So |z| can never exceed 8.5717 standard deviations. Not rarely — never. A true normal distribution goes past that about once in 1017 draws, which is vanishingly rare and is not the same as impossible. If you are modelling anything where the extreme tail is the point, this method has a hard edge you did not put there.
And the textbook version returns Infinity
If u₁ comes back as exactly zero, ln(0) is −∞ and z is Infinity. Most published implementations of Box-Muller do not guard against it, because it is rare enough never to show up in testing and certain enough to show up eventually.
This page redraws when u₁ is zero. It costs one comparison.
Your data is probably not normal
The normal distribution is a model, and a good one for sums of many small independent effects. It is a poor one for incomes, city sizes, file sizes, word frequencies, insurance claims and most things people reach for it for — all of which have fatter tails than it allows.
Generating normal numbers is easy. Deciding that normal is the right shape is the hard part, and nothing on this page helps with it.
Where the randomness comes from
Each uniform is built from eight bytes of
crypto.getRandomValues(), assembled into a 53-bit
value — the full precision a double can carry. Not
Math.random(), and no fallback.