but it also has a 32-bit state. There are proposals for adding strong random number generation to PHP. Stronger methods A variety of methods exist for generating strong, cryptographically secure random passwords. On Unix platforms /dev/random and /dev/urandom are commonly used, either programmatically or in conjunction with a program such as makepasswd. Windows programmers can use the Cryptographic Application Programming Interface function CryptGenRandom. The Java programming language includes a class called SecureRandom. Another possibility is to derive randomness by measuring some external phenomenon, such as timing user keyboard input. Many computer systems already have an application (typically named "apg") to implement FIPS 181. FIPS 181—Automated Password Generator—describes a standard process for converting random bits (from a hardware random number generator) into somewhat pronounceable "words" suitable for a passphrase. However, in 1994 an attack on the FIPS 181 algorithm was discovered, such that an attacker can expect, on average, to break into 1% of accounts that have passwords based on the algorithm, after searching just 1.6 million passwords. This is due to the non-uniformity in the distribution of passwords generated, which can be addressed by using longer passwords or by modifying the algorithm. Bash Here is a code sample that uses /dev/urandom to generate a password with a simple Bash function. This function takes password length as a parameter, or uses 16 by default: function mkpw() { LC_ALL=C tr -dc '[:graph:]' < /dev/urandom | head -c ${1:-16}; echo; } Java Here is a code sample (adapted from the class PasswordGenerator) that uses SecureRandom to generate a 10 hexadecimal character password: char[] symbols = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'}; int length = 10; Random random = SecureRandom.getInstanceStrong(); // as of JDK 8, this returns a SecureRandom implementation known to be strong StringBuilder sb = new StringBuilder(length); for (int i = 0; i < length; i++) { int randomIndex = random.nextInt(symbols.length); sb.append(symbols[randomIndex]); } String password = sb.toString(); JavaScript This example uses the Node.js Crypto module to generate cryptographically secure random numbers with uniform distribution. "use strict"; const { randomInt } = require("crypto"); const secret = (length = 64) => { const upperCase = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; const lowerCase = "abcdefghijklmnopqrstuvwxyz"; const digits = "0123456789"; const minus = "-"; const underline = "_"; const special = "!\"#$%&'*+,./:;=?@\\^`|~"; const brackets = "[]{}()<>"; const all = upperCase + lowerCase + digits + minus + underline + special