The use of simple quantum processes promises to provide numbers that no physical observer could predict, but in practice, unwanted noise and imperfect devices can compromise fundamental randomness and protocol security. The ultimate random number generators take advantage of quantum nonlocality to certify unpredictability—including to an adversary—even in the absence of trust in devices. We demonstrate a generator of public or private randomness based on the quantum steering task. We use polarization-entangled photon pairs to certify and extract randomness in a one-sided device-independent framework, with the detection loophole closed. Our work enables nonlocality-based certified randomness generation in environmental regimes where fully-device-independent protocols are not feasible.