use that data and represent it as some printable stringįor the first part, PHP > 5.3.0 provides the function openssl_random_pseudo_bytes.

use some secure source of randomness to get random data.

Let's break the problem down into the constituent parts which are: This answer will circumvent the count/strlen issue as the security of the generated password, at least IMHO, transcends how you're getting there.

a requirement for some 3rd party library and I thought it might be interesting to show what it might take to do it yourself.

a RNG that isn't considered cryptographically secure.

a smaller character space than you wanted so that either brute-forcing is easier or the password must be longer for the same entropy.

I'm going to post an answer because some of the existing answers are close but have one of: Throw new Exception('$keyspace must be at least two characters long') $keyspace = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ' * string $keyspace A string of all possible characters * int $length How many characters do we want? * For PHP 7, random_int is a PHP core function * pseudorandom number generator (random_int) * Generate a random string, using a cryptographically secure

With a secure random integer generator on hand, generating a secure random string is easier than pie: 8 letter password generator

Using our random_int() polyfill is probably safer than writing your own implementation. If you're still on PHP 5.x, we wrote a PHP 5 polyfill for random_int() so you can use the new API before PHP 7 is released. This library has been audited by industry security experts, as well as myself.įor developers who prefer inventing your own solution, PHP 7.0.0 will provide random_int() for this purpose. The simple, secure, and correct answer to password generation in PHP is to use RandomLib and don't reinvent the wheel. The requirement for a CSPRNG can be relaxed for the general case of random strings, but not when security is involved. Since you are generating a password, you need to ensure that the password you generate is unpredictable, and the only way to ensure this property is present in your implementation is to use a cryptographically secure pseudorandom number generator (CSPRNG).

If you don't have random_int(), use random_compat.Use random_int() and the given random_str() below.