Laravel Insecure Random Numbers: How to Replace rand() and mt_rand() with Cryptographic Alternatives

The Problem

How to Fix

1. 1

   Find insecure random usage in your code

   Search for rand() and mt_rand() in security-sensitive contexts:

   grep -rn 'rand(\|mt_rand(\|array_rand(\|shuffle(' app/ --include='*.php'

   Look specifically for usage in: - Token generation - Password/PIN creation - OTP codes - Nonce or salt generation - Random filename generation for uploads - Lottery/selection logic with financial impact

2. 2

   Replace with cryptographically secure alternatives

   Use these replacements:

   // Random integers
   // BEFORE: rand(100000, 999999)
   // AFTER:
   random_int(100000, 999999);

   // Random strings/tokens
   // BEFORE: md5(mt_rand())
   // AFTER:
   Str::random(40);          // Laravel helper (uses random_bytes)
   bin2hex(random_bytes(20)); // Raw PHP

   // Random bytes
   // BEFORE: mt_rand() based
   // AFTER:
   random_bytes(32);

   // Shuffling arrays securely
   // BEFORE: shuffle($array)
   // AFTER: Use a Fisher-Yates shuffle with random_int()

3. 3

   Use Laravel helpers for common patterns

   Laravel provides secure random generation out of the box:

   // Random string
   use Illuminate\Support\Str;
   Str::random(40);     // 40-char random string
   Str::uuid();         // UUID v4
   Str::orderedUuid();  // Time-ordered UUID

   // Token generation
   $token = hash('sha256', Str::random(60));

   // Unique filenames
   $filename = Str::uuid() . '.' . $file->extension();

   All of these use random_bytes() internally.

How to Verify

grep -rn 'mt_rand(\|\brand(' app/ --include='*.php' | grep -v '// safe\|// non-security'

Prevention

Frequently Asked Questions