PHP Random String Generator... not so random

Question

I always thought my code generated pretty random strings but I've been pressing F5 for about 10 minutes and I display 10 strings at once and I have had THREE DUPLICATES, UNIBON, ZANOPE and ZOTAXS.

Can anyone explain why this is when I though there code be 26^6 possibilities?

$chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
$pass = '';
for ($i = 0; $i < $len; $i++){
    $pass .= $chars[(rand() % strlen($chars))];
}
return $pass;

Any advice would be much appreciated.

Thanks

Using mt_rand the first duplicate takes on average between 10 and 60 seconds, that seems okay doesn't it?

echo 'start: '.date('H:i:s');
for ($i = 1; ; $i++) {
    $testarr[]  = passGen(6);
    $new        = passGen(6);
    if (in_array($new,$testarr)){
        echo '<br>end: '.date('H:i:s');
        echo '<br>string: '.$new;
        echo '<br>count: '.count($testarr);
        break;
    }
}

for ($i = 0; $i < $len; $i++){ where do you define $len ? — user1269636
– user1269636, Commented Mar 28, 2012 at 14:29
I've now added rand(0,strlen($chars)) I'm just trying to create a unique name for a company as all ideas that have been put forward to the MD have been rejected lol — Jason
– Jason, Commented Mar 28, 2012 at 14:32
If you're using PHP4 or PHP5, you should be able to use mt_rand() to get a better random number as rand() is known to have problems per the PHP manual. see (php.net/manual/en/function.mt-rand.php) — JamieHoward
– JamieHoward, Commented Mar 28, 2012 at 14:34

Pete · Accepted Answer · 2012-03-28 14:34:09Z

1

Why don't you hash a random number then take a random substring from the hash?

answered Mar 28, 2012 at 14:34

Pete

1,30910 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Jason Over a year ago

Not a bad idea, I'm going to see how long it takes PHP to create a duplicate with mt_rand and if it's too quick then I'll try your method, thanks

Userbn · Accepted Answer · 2012-03-28 14:37:37Z

0

You should try this :

$chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
        $pass = '';
        $length = strlen($chars)-1;
        for ($i = 0; $i < 10; $i++){
            $randomNumber = rand(0,$length);
            $pass .= substr($chars,$randomNumber,1);
        }
        return $pass;

answered Mar 28, 2012 at 14:37

Userbn

3421 silver badge2 bronze badges

Comments

Songo · Accepted Answer · 2012-03-28 16:02:37Z

0

You should use mt_rand.

mt_rand is way better than rand. From the PHP manual

Many random number generators of older libcs have dubious or unknown characteristics and are slow. By default, PHP uses the libc random number generator with the rand() function. The mt_rand() function is a drop-in replacement for this. It uses a random number generator with known characteristics using the » Mersenne Twister, which will produce random numbers four times faster than what the average libc rand() provides.

That aside you can use this function instead to generate random strings with the length you wish ;)

function random($length = 10)
{      
    $chars = 'BCDFGHJKLMNPQRSTVWXYZAEIUO';

    for ($i = 0; $i < $length; $i++)
    {
        $pass .= ($i%2) ? $chars[mt_rand(19, 25)] : $chars[mt_rand(0, 18)];
    }

    return $pass;
}

This function can be used easily to generate CAPTCHAs too ;)

edited Mar 28, 2012 at 16:02

answered Mar 28, 2012 at 14:44

Songo

5,7568 gold badges63 silver badges100 bronze badges

3 Comments

martinstoeckli Over a year ago

What is the idea of grouping the alphabet ($chars), and why don't you use the whole alphabet (0-25)? It will reduce the possible combinations.

Songo Over a year ago

@martinstoeckli sorry my bad (^^,) I forgot to rearrange the alphabet to work for the example. I usually arrange the letters in certain order to create easily pronounceable words (i.e. constant, vowel,constant,vowel,...etc.)

beltorak Over a year ago

@Songo if you don't mind archaic words, a sentence with 26 letters: "Cwm fjord bank glyphs vext quiz."

dwilkins · Accepted Answer · 2012-05-01 16:39:54Z

0

I think that's just the nature of the beast. Increase the length to 7 and add some more characters and the probability of duplicates goes down. This is what I used to test:

<?php
$len = 6;
# Remove characters that can be mistaken for others, I,0,L,1 and 0
$chars = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789';
for ($j=0;$j<100000;$j++) {
  $pass = '';
  for ($i = 0; $i < $len; $i++){
    $pass .= $chars[(rand() % strlen($chars))];
  }
  if(isset($saved[$pass])) {
    echo "Password \"$pass\" on iteration $j has duplicate(s) from iteration(s) " . implode(',',$saved[$pass]) . "\n";
  }
  $saved[$pass][] = $j;
}
?>

Using mt_rand() vs rand() didn't change the output much

answered May 1, 2012 at 16:39

dwilkins

2,2091 gold badge12 silver badges9 bronze badges

Collectives™ on Stack Overflow

PHP Random String Generator... not so random

4 Answers 4

1 Comment

Comments

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related