Abstract. Let p be a prime and let a and c be integers modulo p. The quadratic congruential generator (QCG) is a sequence (vn) of pseudorandom numbers defined by the relation vn+1 ≡ av 2 n +c mod p. We show that if sufficiently many of the most significant bits of several consecutive values vn of the QCG are given, one can recover in polynomial time the initial value v0 (even in the case where the coefficient c is unknown), provided that the initial value v0 does not lie in a certain small subset of exceptional values. 