I am using some "magic link" one-time passcodes for automatically logging users in for a specific purpose on our website.

My plan is to generate a hash based on the datetime, users specific "ID" and a random int.

Then take this hash and use it a prefix to uniqid as per:

$hash = sha1(date("Y-m-d H:i:s") . $memberId . random_int(0, 9999) );
$OTP = uniqid($hash, true);

After a bit of thinking I guess the use of uniqid is pretty redundant, but would it actually make it less secure to do it this way?

  • 1
    I edited your title to clarify the distinction between One-Time Passcodes and One-Time Pad. Please don't be afraid to spell things out if there is a potential to mistake things.
    – MechMK1
    May 22 '19 at 12:58

First, if you take a hash of data containing in part random values, you would be better served by using directly random data, with the random_bytes function.

For the usage of uniqid, you should first read its documentation. You are not using the "prefix" argument as it is meant to be used.

To directly answer your question, you should avoid using uniqid because it is not meant to be used to authenticate users. You could instead use a 16 bytes string returned by random_bytes, encoded in hexadecimal or base64.

  • Excellent, thank you for your time - I will do exactly that.
    – Aphire
    May 22 '19 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.