Random math in Roblox isn't as simple as you think
I spent three weeks debugging a combat system where damage calculations felt "off." Players kept complaining that boss attacks were way too consistent, like they could predict every hit. Turns out the problem wasn't in my logic at all. It was how math.random() behaves by default in Roblox Luau. The core function is just math.random(), math.random(min, max), and math.randomseed(). That's it. Three forms, and most beginners only use the first two without understanding the consequences. math.random() returns an integer between 1 and the maximum value you pass, or anywhere from 1 to 2^53 if you call it with no arguments at all. math.random(min, max) narrows that range. math.randomseed(n) resets the internal generator so your sequence starts over at n. Here's what nobody tells you: Roblox doesn't automatically seed the random generator differently on each server run. When I first shipped a dungeon crawler, every single server spawned the same rooms in the same order. Players figured it out within hours. The fix was adding math.randomseed(os.time()) to the server startup script. One line, game saved.
Where things break in practice
The biggest trap is calling math.randomseed() inside a loop or a frequently triggered event. I had a player respawn script that called math.randomseed(tick()) on every death. Since tick() returns time with second-level granularity, respawn events happening within the same second produced identical random drops. Took me forever to trace because the bug only appeared under heavy testing when players were dying repeatedly. Another thing: math.random() in Luau generates a 53-bit mantissa float when called with no upper bound. That means if you're doing something like math.random() * 100 and then rounding, you're not getting uniform distribution across every possible integer. The floating point edge cases matter more than you'd expect in loot tables. I learned this the hard way when a rarity system I built had a 0.03% discrepancy that accumulated over thousands of spawns. Changing the calculation to use math.floor(math.random() * max) + 1 fixed it, but tracking down the source took two full days. There's also the question of using Random.new() versus math.random(). The Random class gives you an isolated generator instance with its own seed. This is better when you need multiple independent random streams. My tower defense game uses one Random instance for enemy spawn timing and another for projectile variance. They never interfere. The standard math.random() function shares one global state, which means any module in your game can accidentally mutate it and corrupt another system's randomness.
When math.random() is the wrong tool
If you need cryptographic security, like a gambling minigame or anything handling real value transactions, do not use math.random(). It is not cryptographically secure. Period. Anyone who figures out enough output from your generator can reverse-engineer the seed and predict future values. For anything that matters, you'd need an external API or a custom PRNG implementation. I've seen developers ignore this and then have their loot systems exploited by people who knew exactly how to manipulate it. Also worth noting: if you're running the same seed across multiple platforms, Luau's math.random() may produce slightly different sequences between the old Lua 5.1 runtime and modern Luau. Roblox has been migrating engines, and this caused mismatched random events between older and newer client builds during a beta test. Everything felt fine until I compared logs side by side and saw the exact divergence.
Get the Full Details
A working pattern I actually use
For most projects I seed once at server startup with os.time() combined with a server-specific identifier, then stick to Random.new() instances for everything else. No re-seeding mid-game unless you explicitly need a fresh sequence. If you need reproducibility for testing, pass a fixed seed and log it so you can recreate the exact conditions. I keep a comment in every script now with the seed value on the first line. Makes debugging way easier when something breaks. The whole thing takes maybe ten minutes to set up properly. Most people skip it and spend ten hours chasing ghost bugs instead. Your call.
