Fully passive quantum random number generation with untrusted light

Quantum random number generators (QRNGs) harness the inherent unpredictability of quantum mechanics to produce true randomness. Yet, in many optical implementations, the light source remains a potential vulnerability—susceptible to deviations from ideal behavior and even adversarial eavesdropping. Source-device-independent (SDI) protocols address this with a pragmatic strategy, by removing trust assumptions on the source, and instead rely on realistic modeling and characterization of the measurement device. In this work, we enhance an existing SDI-QRNG protocol by eliminating the need for a perfectly balanced beam splitter within the trusted measurement device, which is an idealized assumption made for the simplification of security analysis. We demonstrate that certified randomness can still be reliably extracted across a wide range of beam-splitting ratios, significantly improving the protocol’s practicality and robustness. Using only off-the-shelf components, our implementation achieves real-time randomness generation rates of 0.347 Gbps. We also experimentally validate the protocol’s resilience against adversarial attacks and highlight its self-testing capabilities. These advances mark a significant step toward practical, lightweight, high-performance, fully passive, and composably secure QRNGs suitable for real-world deployment.