Usually once you register in a website you need to visit a url like:


Does the ^random_string^ necessarily need to be cryptographically pseudorandom instead of a time-based random one?

I mean is a necessity to use cryptographically secure randomness such as openssl_random_pseudo_bytes or a time based one such as:

$string = array_shuffle(explode('','ABCDEFGHIJKLMNOPQRSTUVWXYZ'));

The most common example using the openssl_random_pseudo_bytes is:

$length = 10;//Some size.
$token = bin2hex(openssl_random_pseudo_bytes($length));

1 Answer 1


As long as the bad randomness could be exploited in any meaningful way by any attacker, you should use a cryptographically secure source.

This is obviously true for user activation tokens, since it could allow an attacker to bypass other security measures (like email verification).

  • 1
    Add to that that the shuffle could be predicted and you got a perfect auth bypass.
    – LvB
    Dec 22, 2021 at 17:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .