The RTL-SDR dongle on the home lab box earns its keep monitoring ATC frequencies and weather satellites. But between those transmissions — at 1700 MHz, where nothing broadcasts in the UK — there's just noise. Thermal noise from the receiver electronics. Atmospheric radio noise. And depending on how you want to describe it, a contribution from cosmic background radiation: the 13.8-billion-year-old echo of the Big Bang that fills the entire universe at a constant temperature of about 2.7 Kelvin.
That noise is genuinely, physically random. Not "hard to predict" random. Not "seeded from a clock" random. Quantum-mechanical randomness, all the way down. And I had a Python library for talking to the dongle already installed.
The obvious question: could I turn that static into a password generator?
First — the honest caveat
Before getting into how it works, I want to be upfront about something: /dev/urandom is already fine. Modern Linux kernels gather entropy from hardware interrupts, thermal sensors, timing variations — all sorts of physical noise sources — and run it through a cryptographically secure algorithm. It passes every statistical randomness test you throw at it. If you're generating passwords for real things in the real world, /dev/urandom is not the problem.
With that said — who doesn't want their passwords made from the thermal noise of the universe? Let's go.
How it works
The pipeline from "antenna" to "random bytes" is actually straightforward. The dongle streams IQ samples (interleaved in-phase and quadrature measurements) at about 2 million samples per second. At 1700 MHz with nothing transmitting, those samples are dominated by noise. The trick is extracting the genuinely random bits from them and discarding the rest.
The Von Neumann step is the interesting one. Even hardware thermal noise has a slight bias — the hardware isn't perfectly balanced. The debiaser removes that bias without any assumptions about the distribution: if you see 01, output a 0; if you see 10, output a 1; throw away 00 and 11. It roughly halves the bit yield, but with millions of samples per second coming in, that's fine.
SHA-256 whitening is the final polish — it ensures the output bytes have full entropy density with no residual correlations between them. The same technique is used by hardware security modules and proper HSMs.
What it generates
A full web UI running on the home lab box gives access to everything the entropy engine can produce:
Character-based with a length slider. Four charsets: full, letters + numbers, letters only, or PIN digits.
Word-based passwords from the EFF list or a custom Pixel City word list. More on this below.
Full dice notation — 2d6, 1d20, 4d6dl1 (drop lowest). Each roll is physically random.
128 to 512-bit hex keys, UUID v4, base64url API tokens, ComfyUI image generation seeds.
N unique numbers from 1 to max — defaults to UK lottery format. Why not.
Paste a list, get a random selection. Useful for all sorts of things.
The Pixel City word list
Diceware passphrases are word-based passwords — something like glitch-kernel-arcade-static — that are both memorisable and genuinely high-entropy. The standard approach uses the EFF's carefully curated word list of 7,776 common English words.
I also built a custom one: the Pixel City word list. It pulls vocabulary from the Glitched Pixel universe — districts and locations (arcade, depot, signal), technology terms (cipher, kernel, proxy, socket), and character names and lore words (pixel, zombie, glitch, pulse). With 200+ words and 4-word combinations, there are over a billion possible passphrases — more than enough entropy, and they sound like they came from a cyberpunk city because they did.
A passphrase like pixel-circuit-neon-vector is genuinely strong and genuinely mine in a way that correct-horse-battery-staple never quite is.
The bit I'm most pleased with
Every time you generate something, a live FFT spectrum display at the top of the UI shows a snapshot of the actual radio noise the entropy came from. It polls every half second and draws the frequency spectrum as a scrolling waveform — cyan line on a dark background, exactly the kind of thing you'd expect from a Pixel City instrument.
You can literally watch the static that became your password. The randomness isn't abstract — it has a shape, a texture, a visible physical source. That's the part that makes this feel genuinely different from every other password generator on the internet.
There's also an entropy pool bar showing the Linux kernel's current entropy level, and a live status indicator that tells you whether the dongle is online or not. If something else grabs the dongle (it can only be owned by one process at a time), the UI tells you clearly rather than silently returning garbage.
The entropy daemon
One extra piece running as a background service: an entropy daemon that continuously feeds radio-sourced randomness into the Linux kernel entropy pool. The kernel uses this pool for /dev/urandom, so technically everything on the home lab box that generates random numbers is now partly powered by the radio.
It's a small thing. But it means the whole system benefits, not just the web UI.
What's next — the public page
Phase 2 is a public page on this site. The plan is a live entropy engine that anyone can use — password generator, diceware passphrases, dice roller, lottery numbers — all powered by the actual dongle running in the background.
The FFT waveform showing real-time radio noise is going on that page too. It's the kind of thing that makes people stop and actually read what they're looking at rather than just clicking generate and moving on.
I'm not claiming it'll replace proper password management. But for the moment someone needs a quick strong password, or wants to roll a d20 with something that can genuinely claim to be physically random, it should be something worth coming back to.
The dongle is already on. The static is already there. Might as well use it.