<p>I know that just using <code>rand()</code> is predictable, if you know what you're doing, and have access to the server.</p>

<p>I have a project that is <strong>highly</strong> dependent upon choosing a random number that is as unpredictable as possible. So I'm looking for suggestions, either other built-in functions or user functions, that can generate a <em>better</em> random number.</p>

<p>I used this to do a little test:</p>

<pre><code>$i = 0;

while($i &lt; 10000){
    $rand = rand(0, 100);

    if(!isset($array[$rand])){
        $array[$rand] = 1;
    } else {
        $array[$rand]++;
    }

    sort($array);
    $i++;
}
</code></pre>

<p>I found the results to be evenly distributed, and there is an odd pattern to the number of times each number is generated.</p>

[{'answer_id': 5679, 'author': 'Justin Yost', 'author_id': 657, 'author_profile': 'https://Stackoverflow.com/users/657', 'pm_score': 1, 'selected': False, 'text': '<p>Variation on @KG, using the milliseconds since EPOCH as the seed for rand?</p>\n'}, {'answer_id': 5820, 'author': 'Christian Lescuyer', 'author_id': 341, 'author_profile': 'https://Stackoverflow.com/users/341', 'pm_score': 6, 'selected': True, 'text': '<p>Adding, multiplying, or truncating a poor random source will give you a poor random result. See <a href="http://random.org/randomness/" rel="noreferrer">Introduction to Randomness and Random Numbers</a> for an explanation.</p>\n\n<p>You\'re right about PHP rand() function. See the second figure on <a href="http://random.org/analysis/" rel="noreferrer">Statistical Analysis</a> for a striking illustration. (The first figure is striking, but it\'s been drawn by Scott Adams, not plotted with rand()).</p>\n\n<p>One solution is to use a true random generator such as <a href="http://random.org/integers/" rel="noreferrer">random.org</a>. Another, if you\'re on Linux/BSD/etc. is to use <a href="http://en.wikipedia.org/wiki/Urandom" rel="noreferrer">/dev/random</a>. If the randomness is mission critical, you will have to use a <a href="http://en.wikipedia.org/wiki/Hardware_random_number_generator" rel="noreferrer">hardware random generator</a>.</p>\n'}, {'answer_id': 5835, 'author': 'Kevin', 'author_id': 40, 'author_profile': 'https://Stackoverflow.com/users/40', 'pm_score': 3, 'selected': False, 'text': '<p><a href="http://random.org/clients/http/" rel="nofollow noreferrer">random.org</a> has an API you can access via HTTP.</p>\n\n<blockquote>\n  <p>RANDOM.ORG is a true random number service that generates randomness\n  via atmospheric noise.</p>\n</blockquote>\n'}, {'answer_id': 6344, 'author': 'Christian Lescuyer', 'author_id': 341, 'author_profile': 'https://Stackoverflow.com/users/341', 'pm_score': 2, 'selected': False, 'text': '<p>I would be wary of the impression of randomness: there have been many experiments where people would choose the less random distribution. It seems the mind is not very good at producing or estimating randomness.</p>\n\n<p>There are good articles on randomness at <a href="http://www.fourmilab.ch/hotbits/" rel="nofollow noreferrer">Fourmilab</a>, including another <a href="https://www.fourmilab.ch/hotbits/secure_generate.html" rel="nofollow noreferrer">true random generator</a>. Maybe you could get random data from both sites so if one is down you still have the other.</p>\n\n<p>Fourmilab also provides a <a href="http://www.fourmilab.ch/random/" rel="nofollow noreferrer">test program</a> to check randomness. You could use it to check your various myRand() programs. </p>\n\n<p>As for your last program, if you generate 10000 values, why don\'t you choose the final value amongst the 10 thousand? You restrict yourself to a subset. Also, it won\'t work if your $min and $max are greater than 10000.</p>\n\n<p>Anyway, the randomness you need depends on your application. rand() will be OK for an online game, but not OK for cryptography (anything not thoroughly tested with statistical programs will not be suitable for cryptography anyway). You be the judge!</p>\n'}, {'answer_id': 18867906, 'author': 'Aaron Gong', 'author_id': 2215486, 'author_profile': 'https://Stackoverflow.com/users/2215486', 'pm_score': 2, 'selected': False, 'text': '<p>Another way of getting random numbers, similar in concept to getting UUID</p>\n\n<p>PHP Version 5.3 and above</p>\n\n<pre><code>openssl_random_pseudo_bytes(...)\n</code></pre>\n\n<p>Or you can try the following <a href="https://github.com/ramsey/uuid" rel="nofollow">library</a> using RFC4122</p>\n'}, {'answer_id': 31444887, 'author': 'Salvador Dali', 'author_id': 1090562, 'author_profile': 'https://Stackoverflow.com/users/1090562', 'pm_score': 1, 'selected': False, 'text': '<p>A new <a href="https://wiki.php.net/rfc/easy_userland_csprng" rel="nofollow noreferrer">PHP7</a> there is a function that does exactly what you needed: it generates <a href="http://php.net/manual/en/function.random-int.php" rel="nofollow noreferrer">cryptographically secure pseudo-random integers.</a></p>\n\n<pre><code>int random_int ( int $min , int $max )\n</code></pre>\n\n<blockquote>\n  <p>Generates cryptographic random integers that are suitable for use\n  where unbiased results are critical (i.e. shuffling a Poker deck).</p>\n</blockquote>\n\n<p>For a more detailed explanation about PRNG and CSPRNG (and their difference) as well as why your original approach is actually a bad idea, please read my <a href="https://stackoverflow.com/a/31443898/1090562">another highly similar answer</a>.</p>\n'}]
['https://Stackoverflow.com/questions/5611', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/115/']