PHP random string generator function

Generating random strings in PHP is something I end up doing in almost every serious web project. Whether I build authentication systems, API integrations, file upload handlers, or internal tools, I always need secure and reliable ways to generate random tokens. In this guide, I explain how I generate secure random strings in PHP, when I use each method, and what you should avoid if security matters.

Random string generation is not just about producing “something random.” In real-world applications, the quality of randomness directly affects security. Weak randomness can expose password reset tokens, API keys, or session identifiers to prediction attacks. That is why I never rely on outdated or non-cryptographic functions.

Why Random Strings Matter in Modern PHP Applications

I typically generate random strings in PHP for session tokens, email verification codes, password reset links, API keys, invitation codes, and unique file names. In all these cases, predictability is dangerous. If an attacker can guess the pattern, they can hijack accounts or access protected resources.

If the random string protects authentication or sensitive data, it must be generated using cryptographically secure functions.

For that reason, I avoid rand(), mt_rand(), and str_shuffle() for anything security-related. These functions are not designed for cryptographic security and should never be used for token generation.

Method 1: random_bytes() with bin2hex() (My Default Choice)

In modern PHP (7.0+), my go-to solution is combining random_bytes() with bin2hex(). This approach is fast, secure, and built directly into PHP.

function generateRandomStringSecure($length = 32) {
  $bytes = random_bytes((int) ceil($length / 2));
  return substr(bin2hex($bytes), 0, $length);
}

The logic is simple. random_bytes() generates cryptographically secure random bytes from the operating system. Then bin2hex() converts those bytes into hexadecimal characters (0-9 and a-f). Because each byte becomes two hex characters, I use ceil() to ensure the final string length is correct.

I use this method for API tokens, session identifiers, CSRF tokens, and any internal secure identifiers. It is efficient and extremely reliable.

Method 2: random_int() with a Custom Character Pool

Sometimes I need readable random strings, especially for invitation codes, short URLs, or public identifiers. In those situations, I use random_int() with a defined character set.

function generateRandomStringSimple($length = 16, 
  $alphabet = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ') {

  $alphabetLength = strlen($alphabet);
  $randomString = '';

  for ($i = 0; $i < $length; $i++) {
    $randomString .= $alphabet[random_int(0, $alphabetLength - 1)];
  }

  return $randomString;
}

The advantage here is flexibility. I can remove ambiguous characters like O and 0, or add special symbols when generating passwords. Because random_int() is cryptographically secure, this method is safe for security-sensitive use cases as well.

The only downside is that looping many times for very long strings can be slightly slower than generating raw bytes. In practice, this is rarely a problem unless you generate thousands of long tokens per second.

Method 3: openssl_random_pseudo_bytes() (Legacy Support)

In older PHP environments (before PHP 7), I sometimes rely on openssl_random_pseudo_bytes(). While I prefer random_bytes(), this function can serve as a fallback in legacy projects.

function generateRandomStringOpenSSL($length = 32) {
  $bytes = openssl_random_pseudo_bytes((int) ceil($length / 2), $cryptoStrong);

  if ($bytes === false || $cryptoStrong === false) {
    throw new RuntimeException('OpenSSL RNG not strong on this system');
  }

  return substr(bin2hex($bytes), 0, $length);
}

I always check the $cryptoStrong flag to ensure strong randomness. If the system cannot provide cryptographically secure randomness, I prefer failing rather than generating weak tokens.

Security Comparison Overview

In modern PHP applications, both random_bytes() and random_int() are cryptographically secure and recommended. OpenSSL-based generation is acceptable for legacy systems, but I avoid it when newer functions are available.

From my experience, the choice comes down to output format. If I need raw security and do not care about readability, I use random_bytes(). If I need custom characters, I use random_int() with a controlled alphabet.

Production Tips for Generating Random Strings in PHP

Over the years, I have developed a few best practices. First, I always define the intended length clearly and ensure trimming is handled correctly. Second, I add prefixes when necessary, such as usr_ or api_, to categorize identifiers logically. Third, I never store sensitive tokens in plain text if they represent authentication credentials. When appropriate, I hash them before saving.

If I need URL-safe tokens, I sometimes generate raw bytes and encode them using Base64URL encoding, replacing special characters like plus and slash with URL-safe alternatives.

Final Thoughts

Generating random strings in PHP is simple, but doing it correctly is critical for application security. I strongly recommend using random_bytes() or random_int() in all modern PHP applications. These built-in functions provide cryptographically secure randomness and remove the risks associated with outdated approaches.

Whenever I design authentication systems, API integrations, or secure identifiers, I treat randomness as a core security component rather than a minor implementation detail. Choosing the right method ensures that tokens remain unpredictable, secure, and reliable in production environments.