This question already has an answer here:

How can I generate a truly cryptographically secure random text string in PHP (to be used as password)?

Allowed: a-z, A-Z, 0-9 Blocked: Everything else

marked as duplicate by Xander, Steffen Ullrich, Anders, Serge Ballesta, S.L. Barth Apr 11 '17 at 6:45

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Welcome to Information Security SE. Can you the reference the URL you used? Could you clarify the part of the question where you mention the list of characters that are / aren't allowed? Also, as this is a PHP-specific question it's more relevant on StackOverflow, though it seems like a duplicate. – Jedi Apr 10 '17 at 19:13
  • What ? A duplicate ? – Laurent Apr 10 '17 at 20:18

Computers aren't very good at generating "true" randomness - PHP alone will not give you that. But you can get something that is unpredictable enough to be used for password generation.

Use int random_int ( int $min , int $max ). It will use a CSPRNG.

How to go from being able to generate random integers in a certain interval to generating a random password is a programming question, and not a security question. So I will only shortly suggest that you make an string of all allowed characters, and have a for loop that picks a random letter from that string at a time.

  • 2
    This recommendation regarding picking a random letter from an array of allowable characters is equivalent to "Base-X" encoding. Base-36 and Base-64 encodings are fairly well-accepted methods of encoding more complex binary data in a string of typeable, printable characters. – KeithS Apr 10 '17 at 22:35

I would say that in computer science talking about "truly random text string" isnt just that easy.

Some stuff I would do is to use the rand function and set the 26 letters as 0-25 and the 10 numbers as 26-35. So if you rand(0,35), if you get the 3 you have a d to your password, same if you want to get uppercase letters, you include them to the rand() function.

Note this is for getting pseudorandom elements, so if you have each one of the elements as "pseudorandom", and you have enough big passwords made this way, its impossible with the computing capacity that we have today, that some computer could get your password.

I think this is the quicker way to sort this out.

  • rand is not the right tool for the task. Read the warning statement on the link you posted. – Anders Apr 10 '17 at 20:20

Did you mean something like this?


$alphabet = array('a','b','c','d','e','f','g','h','i','j','k','l','m','o','p','q','r','s','t','u','v','w','x','y','z','A','B','C','D','E','F','G','H','I','J','K','L','M','O','P','Q','R','S','T','U','V','W','X','Y','Z','0','1','2','3','4','5','6','7','8','9');
$random = array_rand($alphabet, 10); #set the length
foreach ($random as $letter) { echo $alphabet[$letter]; }

  • I don't think that array_rand is cryptographically secure, so it should not be used for generating passwords. According to the docs it uses a Mersenne twister at best. – Anders Apr 11 '17 at 9:25
  • Well, there is no mentioning of cryptography in OP. Just about generating a random text string, which is what the above code does. But I do agree with you regarding new age array_rand function. – user633551 Apr 11 '17 at 13:50
  • The name is a bit misleading I guess - your random numbers needs to be "cryptographically secure" even if your not doing crypto. OP mentions passwords, and those should always be generated using a cryptographically secure PRNG. – Anders Apr 11 '17 at 14:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.