Generate a Secure Random Password in PHP

Use these simple PHP snippets to generate random passwords for user accounts, admin panels, or any secure authentication system.

🔐 Why Use Random Password Generators?

Security starts with strong passwords. Manually chosen passwords are often weak and predictable. Automating password generation in PHP allows you to consistently create strong, secure strings for users or system processes.

🧪 Simple Random Password Generator

This basic method uses str_shuffle() to randomly shuffle characters.

<?php
function generatePassword($length = 12) {
  $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
  return substr(str_shuffle($chars), 0, $length);
}
echo generatePassword();
?>

Note: This is suitable for low-risk use cases, but it's not cryptographically secure.

🔐 Cryptographically Secure Generator

For better security, use random_int() to select characters:

<?php
function securePassword($length = 16) {
  $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_';
  $password = '';
  $max = strlen($chars) - 1;
  for ($i = 0; $i < $length; $i++) {
    $password .= $chars[random_int(0, $max)];
  }
  return $password;
}
echo securePassword();
?>

This function uses PHP's built-in cryptographically secure random number generator.

⚙️ Customizing Character Sets

You can tweak the character set based on your needs:

<?php
function customPassword($length = 10, $useSymbols = false) {
  $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
  if ($useSymbols) {
    $chars .= '!@#$%^&*()';
  }
  $password = '';
  $max = strlen($chars) - 1;
  for ($i = 0; $i < $length; $i++) {
    $password .= $chars[random_int(0, $max)];
  }
  return $password;
}
echo customPassword(12, true);
?>

💾 Storing Passwords

Never store plain-text passwords! Always hash them using password_hash():

<?php
$password = securePassword();
$hashed = password_hash($password, PASSWORD_DEFAULT);
echo $hashed;
?>

You can verify a password using password_verify().

✅ Best Practices

• Use random_int() instead of rand() for better entropy
• Always hash passwords before storing them
• Use at least 12 characters for strong passwords
• Avoid predictable patterns