One thing worth checking in your code: how crypto.getRandomValues maps to die faces. A naive byte modulo 6 skews the results, since 256 is not divisible by 6, so faces one through four come up slightly more often. The fix is rejection sampling: 252 is the largest multiple of 6 in 256, so accept bytes 0 to 251 and redraw on anything higher.