The lava lamps guarding the internet

Walk into Cloudflare’s San Francisco lobby and the first thing you meet isn’t a server rack or a badge reader. It’s a wall of lava lamps. Something like a hundred of them, glowing and blobbing away like set dressing lifted from a 1970s rec room. It’s also one of the more quietly brilliant pieces of security infrastructure on the modern web.

Cloudflare moves a huge share of the world’s traffic, and at some point they decided the answer to a hard cryptography problem was, of all things, novelty lamps. Here’s why that’s less ridiculous than it sounds.

Computers are hopeless at being random

Encryption runs on secrets, and secrets are built out of random numbers: the keys, tokens, and session IDs that keep your data yours. The whole thing holds up only as long as those numbers stay genuinely unpredictable. Let an attacker guess or reproduce the “random” values a system leans on, and they can start rebuilding keys and pulling the encryption apart thread by thread.

Which runs straight into an awkward fact about computers: they’re deterministic. Feed one the same input and it hands back the same output, every time, forever. That reliability is the entire reason they’re useful, and it’s exactly what makes them terrible at true randomness.

So they fake it. Pseudo-random number generators are algorithms that produce streams that look random enough for most jobs. Every one of them, though, needs a starting value, a seed. Predict the seed and you predict the whole stream that follows. The real question becomes where you find a seed that’s genuinely unguessable, something rooted in the physical world instead of a formula a machine could quietly retrace.

Enter the lamps

That’s the lamps’ job, and the mechanism is lovely in its simplicity. Cloudflare calls it LavaRand. A camera watches the wall around the clock. Wax in a lava lamp never moves the same way twice: heat, convection, and a hundred small imperfections push the blobs up, split them, merge them, and drop them again, in a pattern nobody can predict or repeat. Physical chaos in a bottle.

The wax is only the first layer. The camera adds its own electronic noise. People crossing the lobby shift the light and drag the shadows around. Each frame gets turned into a long string of numbers pulled from the exact value of every pixel, and a wall of drifting, churning wax produces data no algorithm could have seen coming. That stream becomes an entropy source: a pool of real randomness used to help seed the cryptography protecting Cloudflare’s traffic.

Deterministic machines can’t manufacture true randomness, so you borrow it from a world that has plenty to spare.

But couldn’t you just photograph the wall?

Fair question. If the randomness comes off a wall anyone can stand in front of, and Cloudflare parked it in a public lobby, haven’t they handed the secret to anyone with a phone? No, and the reasons are the entire point.

The state never stops moving. A photo freezes one instant of a system that’s already different microseconds later, so knowing what the wall looked like a moment ago tells you nothing about the numbers coming out right now. Your photo also isn’t their photo: reproducing their input would mean matching the exact camera, angle, sensor noise, and moment, to a precision no passerby can touch. And the lamps are never the only ingredient anyway. Their output gets stirred together with other sources before anything cryptographic happens.

If anything, doing it in the open is the flex. Strong security doesn’t lean on hiding the method. It leans on the method being genuinely hard to reverse even when you can see exactly how it works.

Not the first, not the only

This isn’t even a Cloudflare original. The idea traces back to the late 1990s, when Silicon Graphics patented a system that used lava lamp images for the same reason. Cloudflare dusted it off and ran it at scale. The lamps have company, too: other offices lean on their own chaos machines, from a suspended pendulum whose swing can’t be predicted to instruments reading the random decay of radioactive material. Different physics, identical instinct. Reach into the physical world for the unpredictability a computer can’t produce on its own.

Why it stays with us

Part of why the story travels is the contrast. We picture internet security as something cold and abstract, math humming away on a screen somewhere, and then it turns out a real piece of it depends on a lamp you’d expect to find in a dorm room. We love that. It’s the kind of solution that only exists because somebody refused to accept the boring framing of the problem and went looking where nobody else was looking.

The lamps aren’t a gimmick. They’re a tidy, physical answer to a real limitation, and they’re the sort of thing we keep a running list of, quiet proof that the best fixes tend to come from a strange direction.

Next time you notice the little padlock in your address bar, there’s a small chance the security behind it traces back, in part, to a wall of wax blobs drifting slowly up and down in a lobby in San Francisco.