Usually once you register in a website you need to visit a url like:


Does the ^random_string^ necessarily need to be cryptographically pseudorandom instead of a time-based random one?

I mean is a necessity to use cryptographically secure randomness such as openssl_random_pseudo_bytes or a time based one such as:

$string = array_shuffle(explode('','ABCDEFGHIJKLMNOPQRSTUVWXYZ'));

The most common example using the openssl_random_pseudo_bytes is:

$length = 10;//Some size.
$token = bin2hex(openssl_random_pseudo_bytes($length));

1 Answer 1


As long as the bad randomness could be exploited in any meaningful way by any attacker, you should use a cryptographically secure source.

This is obviously true for user activation tokens, since it could allow an attacker to bypass other security measures (like email verification).

  • 1
    Add to that that the shuffle could be predicted and you got a perfect auth bypass.
    – LvB
    Dec 22, 2021 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.