Quantum random number generators (QRNGs) can provide genuine randomness by exploiting the intrinsic probabilistic nature of quantum mechanics, which play important roles in many applications. However, the true randomness acquisition could be subjected to attacks from untrusted devices involved or their deviations from the theoretical modeling in real-life implementation. We propose and experimentally demonstrate a source-device-independent QRNG, which enables one to access true random bits with an untrusted source device. The random bits are generated by measuring the arrival time of either photon of the time–energy entangled photon pairs produced from spontaneous parametric downconversion, where the entanglement is testified through the observation of nonlocal dispersion cancellation. In experiment, we extract a generation rate of 4 Mbps by a modified entropic uncertainty relation, which can be improved to gigabits per second by using advanced single-photon detectors. Our approach provides a promising candidate for QRNGs with no characterization or error-prone source devices in practice.