best practice to generate random token for forgot password

by

In PHP, use random_bytes(). Reason: your are seeking the way to get a password reminder token, and, if it is a one-time login credentials, then you actually have a data to protect (which is – whole user account)

So, the code will be as follows:

//$length = 78 etc
$token = bin2hex(random_bytes($length));

Update: previous versions of this answer was referring to uniqid() and that is incorrect if there is a matter of security and not only uniqueness. uniqid() is essentially just microtime() with some encoding. There are simple ways to get accurate predictions of the microtime() on your server. An attacker can issue a password reset request and then try through a couple of likely tokens. This is also possible if more_entropy is used, as the additional entropy is similarly weak. Thanks to @NikiC and @ScottArciszewski for pointing this out.

For more details see

More Related Contents:

  1. Secure random number generation in PHP
  2. Generating a random password in php
  3. Generating cryptographically secure tokens
  4. Codeigniter CSRF – how does it work
  5. Generate cryptographically secure random numbers in php
  6. What are the best practices for avoiding xss attacks in a PHP site [closed]
  7. When should I use prepared statements?
  8. “Keep Me Logged In” – the best approach
  9. PHP How to find the time elapsed since a date time? [duplicate]
  10. PHP: producing relative date/time from timestamps
  11. How safe are PHP session variables?
  12. PHP $_SERVER[‘HTTP_HOST’] vs. $_SERVER[‘SERVER_NAME’], am I understanding the man pages correctly?
  13. Preventing session hijacking
  14. Getting date format m-d-Y H:i:s.u from milliseconds
  15. Why is using a mysql prepared statement more secure than using the common escape functions?
  16. “slash before every quote” problem [duplicate]
  17. How to create a laravel hashed password
  18. What is a Unix timestamp and why use it?
  19. How to run PHP exec() as root?
  20. Hiding true database object ID in url’s
  21. What’s the disadvantage of mt_rand?
  22. CodeIgniter – why use xss_clean
  23. How to convert MySQL time to UNIX timestamp using PHP?
  24. MySQL ORDER BY rand(), name ASC
  25. Set httpOnly and secure on PHPSESSID cookie in PHP
  26. Does PHP’s $_REQUEST method have a security problem?
  27. is $_SERVER[‘HTTP_REFERER’] safe?
  28. Json: PHP to JavaScript safe or not?
  29. How to generate random password with PHP?
  30. What encryption algorithm is best for encrypting cookies?

Leave a Comment