32-bit integer containing the current number of seconds since January 1, 1970 (see: Unix time). There are about 31 million seconds in a year, so an attacker who knows the year (a simple matter in situations where frequent password changes are mandated by password policy) and the process ID that the password was generated with, faces a relatively small number, by cryptographic standards, of choices to test. If the attacker knows more accurately when the password was generated, he faces an even smaller number of candidates to test – a serious flaw in this implementation. In situations where the attacker can obtain an encrypted version of the password, such testing can be performed rapidly enough so that a few million trial passwords can be checked in a matter of seconds. See: password cracking. The function rand presents another problem. All pseudo-random number generators have an internal memory or state. The size of that state determines the maximum number of different values it can produce: an n-bit state can produce at most different values. On many systems rand has a 31 or 32-bit state, which is already a significant security limitation. Microsoft documentation does not describe the internal state of the Visual C++ implementation of the C standard library rand, but it has only 32767 possible outputs (15 bits) per call. Microsoft recommends a different, more secure function, rand_s, be used instead. The output of rand_s is cryptographically secure, according to Microsoft, and it does not use the seed loaded by the srand function. However its programming interface differs from rand. PHP function pass_gen(int $length = 8): string { $pass = array(); for ($i = 0; $i < $length; $i++) { $pass[] = chr(mt_rand(32, 126)); } return implode($pass); } In the second case, the PHP function microtime is used, which returns the current Unix timestamp with microseconds. This increases the number of possibilities, but someone with a good guess of when the password was generated, for example, the date an employee started work, still has a reasonably small search space. Also, some operating systems do not provide time to microsecond resolution, sharply reducing the number of choices. Finally, the rand function usually uses the underlying C rand function, and may have a small state space, depending on how it is implemented. An alternative random number generator, mt_rand, which is based on the Mersenne Twister pseudorandom number generator, is available in PHP,