Two nearly identical chips leave the factory with numbers that barely diverge: one carries UID 0000c09b9ec2f24c, the other 0000c09b9ec49174, with most of the visible difference tucked into a few characters near the end of the string.
In Phillip Torrone's CircuitPython Day 2026 project, that small change sends the boards toward different compositions: the first becomes song 9eac, D Aeolian at 64 BPM, while the second becomes c228, C melodic minor at 69 BPM.1
No song is stored in the silicon, nor does a model inspect the UID and decide what might sound good; the browser simply applies the same operations to the same number, which is why the result comes back unchanged.
Hardware identity becomes a creative seed.
That distinction makes the experiment more useful than another vaguely random melody generator, because a number created for hardware identity has been turned into the stable input of an entirely deterministic generative system.
Sixteen characters
The hardware is Andrew "bunnie" Huang's Baochip-1x, a 22 nm TSMC SoC built around a VexRiscv RV32 core with 2 MiB of SRAM and 4 MiB of RRAM; the public hardware repository contains its open elements under CERN-OHL-W-2.0.234
Huang presents the part as a high-assurance microcontroller whose architecture is substantially more open than that of most security chips, although Torrone's musical use depends on something much plainer: a stable factory number, 64 bits represented here as sixteen hexadecimal characters.12
Torrone describes a page that reads the UID from hardware through Web Serial in Firefox. Over the last twelve years, Mozilla's Web Serial bug went from an old feature request to a desktop feature; Mozilla says support shipped in Firefox 151 on macOS, Windows and Linux.57
There is a tempting inference worth avoiding here. Torrone calls this his CircuitPython 2026 project, but the sources we checked show no public CircuitPython port for Baochip-1x, so the safe claim is narrower: the documented path runs from hardware identity, through serial, into deterministic JavaScript in the browser.1
Down to 32
The transformation is short enough to follow from end to end, and the original post describes each stage unusually precisely.
The browser passes the sixteen hexadecimal characters through FNV-1a to produce a 32-bit seed, then feeds that seed into xorshift32, a small deterministic pseudo-random generator whose output chooses the musical parameters.1
Drop the prefix from pseudo-random and the description becomes misleading: there is no outside draw, so the same UID yields the same seed, the same xorshift32 sequence and the same musical choices no matter how many times the page is reloaded.
The numbers never become notes directly, because, as Torrone puts it, arbitrary numbers make terrible composers; instead the generator uses its output to choose from a deliberately bounded musical vocabulary.1
Bound the space
That vocabulary contains twelve roots, five minor-ish modes, tempos from 48 to 72 BPM and eight chord progressions, plus choices for a five-to-seven-note motif, bell direction, oscillator detuning and filter cutoff.1
In other words, the design narrows a familiar generative problem: the space of possible numbers is vastly larger than the space of results a composer would willingly listen to.
Mapping eight UID bytes naively to eight MIDI pitches would certainly make a sequence, yet nothing in that mapping would create harmonic coherence; here the number chooses rules from a musical system already designed by the author instead of pretending to "contain" a melody.
Each bar receives a three-note pad, bass, an occasional fifth and a four-note motif, with an FM bell arriving every fourth bar, while the main voice sends three detuned sawtooth oscillators through a swept resonant low-pass filter and then through a high-pass, compressor and feedback delay/reverb.1
The creative work lives there: in designing constraints that turn any seed into an acceptable result.
Two clocks
The browser renders the piece live through Web Audio, with events scheduled ahead against the audio clock instead of being triggered at the last possible moment by JavaScript timers.1
For a sequencer that distinction matters, and MDN recommends the same family of techniques: look slightly ahead and schedule notes against AudioContext.currentTime, preventing timing variation in the JavaScript thread from turning into audible rhythmic variation.6
The composition can also leave the browser synthesizer because the page creates a Standard MIDI File format 0 at 480 PPQ over sixteen bars, including tempo, track name, note events and proper delta timing.1
A user can open that file in a DAW or send it to another synthesizer, preserving the composition selected by the UID while giving the same notes an entirely different final timbre.
Almost identical
Torrone also tested whether nearby hardware identities produced meaningful changes instead of trivial variations.
The two physical boards above differ in every musical field measured by the project, after which the test expanded to 256 sibling UIDs differing only in their final byte; across that small population, all twelve roots, five modes, 25 tempos and eight progressions appeared, alongside 256 distinct song IDs.1
To be sure, that result is useful evidence that small changes at the tail of the UID spread through the generator. A globally unique composition for every possible 64-bit UID, however, is a much stronger claim than the test can support.
The pipeline itself rules out such a guarantee on simple arithmetic grounds.
The hardware identity begins at 64 bits, while FNV-1a reduces it here to 32 bits before generation. The cost of that compression is unavoidable collision: many different 64-bit UIDs must map to the same seed and will then follow an identical deterministic path. For uniformly distributed inputs, the birthday bound puts a roughly 50% chance of at least one seed collision after about 77,000 sampled UIDs, long before anyone approaches the full 64-bit identity space.
The project makes a related distinction itself: its four-character song ID is calculated from the resulting musical parameters and is described by Torrone only as shorthand for "this music," while the full 64-bit UID remains the hardware identifier.1
An audible bug
The project gets more interesting once its output is measured like an instrument rather than merely watched as a browser trick.
Audio measurements found roughly 55% of the energy below 60 Hz in an early version, energy that was mostly useless on laptop speakers while still consuming headroom, so the bass moved up an octave, a 55 Hz high-pass filter was added and the MIDI generator changed with it to keep exported notes aligned with the browser arrangement.1
That fix also reveals the boundary of determinism: the seed may select the same parameters every time, but the author can still revise the function that interprets them, giving the same UID a revised version of its composition after the software changes.
Reproducibility therefore depends on UID + algorithm + musical-vocabulary version. The romantic version, in which a finished song was hiding inside the chip all along, is likely to be the line people remember; the engineering version is more precise and more useful.
Measured or claimed
There is another useful line in the project, this time around the provenance of the identity itself.
When the UID arrives over serial from physical hardware, the page says measured from hardware; if somebody merely supplies ?uid=... in a shared URL, it instead says from link - a claimed uid, not measured here.1
This amounts to provenance rather than cryptographic attestation, since anyone can type a number into a URL; the interface simply refuses to confuse a value read from a device with one asserted by a visitor.
The rest of the system is deliberately short on infrastructure: Torrone describes standalone static HTML with no server application, runtime build, database, account, analytics, CDN or hidden state, while a ?uid= link is enough to regenerate the composition associated with a supplied number on another machine.1
That austerity is almost the point, because there is no table mapping chip numbers to audio files to maintain: the music is a function.
UID → algorithm → score.
A factory serial number has become strangely personal without ever containing a note, and as long as the rule survives, that hardware identity can be played again.