Generate a cryptographic secure random number

Cryptographically Secure Random Number

A cryptographically secure random number generator (CSRNG) is a number that is generated in a way that ensures it cannot be easily predicted. In cryptography, random numbers are crucial as they make up the foundation for security-related applications such as encryption keys and signatures, and communication protocols. A secure random number is one that's unpredictable, distributes fairness amongst all possible numbers, is independent where past and future number generations don't provide clues to make predictions, and is resistant to attack, such as brute force. When we talk about randomness we're actually talking about entropy. The higher the entropy the harder it is that the algorithm will be compromised. A great exmaple of entropy in action is with our free password entropy calculator tool.

By gathering and adding entropy into the generation such as hardware events, they typically provide cryptographic security because of the unpredictable input which cannot be observed by others. To achieve this, in PHP we can use random_int() function, which is considered cryptographically secure.

Pseudo-Random Number Generators

Unlike CSRNGs, pseudo-random number generators (PRNGs) are an alternative way to generate a random number. Common in non-security critical applications like simulations, they offer a random number generation based on an initial seed. However, because they are given the same initial seed, they will produce the same sequence of numbers. Because of this, they aren't truly random numbers and although appear random are deterministic. If you are looking to create randomness that needs to be secure, avoid using PRNGs. In PHP you can create a pseudo-random number using the rand() function.