Dynamic password generation in PHP [duplicate]

use php's built in password_hash(). don't roll your own password hashing unless you are an expert.

for more info see:

http://www.php.net/manual/en/function.password-hash.php

if you absolutely must roll your own(or you are on windows and need something that is compatible with windows php), use some variant of crypt like what i use for devving on windows:

function generateHash($plainText, $encdata = false) { $strength = "08"; //if encrypted data is passed, check it against input if ($encdata) { if (substr($encdata, 0, 60) == crypt($plainText, "$2a$".$strength."$".substr($encdata, 60))) { return true; } else { return false; } } else { //make a salt and hash it with input, and add salt to end $salt = ""; for ($i = 0; $i < 22; $i++) { $salt .= substr("./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", mt_rand(0, 63), 1); } //return 82 char string (60 char hash & 22 char salt) return crypt($plainText, "$2a$".$strength."$".$salt).$salt; } } 

using this is fairly straightforward.

to hash a password do it like so

generateHash($password);

to check a password against a hash(such as the stored hash in a database for a user)

generateHash($password,$storedhash);

edit to generate a random password try this:

function generateString() { $string = ""; for($i=0; $i < 44; $i++) { $x = mt_rand(0, 3); switch($x) { case 0: $string.= chr(mt_rand(97,102));break; case 1: $string.= chr(mt_rand(65,90));break; case 2: $string.= chr(mt_rand(48,57));break; case 3: $string.= chr(mt_rand(103,122));break; } } return $string; } 

There are many way to do this but I found a very simple method which can generate strong password of any length. This method is based on str_shuffle() function which randomly shuffles a string.

<? function generate_password( $length = 8 ) { $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_-=+;:,.?"; $password = substr( str_shuffle( $chars ), 0, $length ); return $password; } ?> 

To generate random password simply pass the desired length of password in this function. If you omit length parameter then it will generate 8 character long password by default.

$password1 = generate_password(); // default length 8 $password2 = generate_password(6); // 6 character long password 

generate_password() is simple but, If you want to strong password then try to Hashing algorithm for it.

You could add a key to your hash and send the timestamp with the query, e.g.:

$time = time(); $hash = md5($key . $time); 

you can also use hash_hmac():more detail LINK

$password = hash_hmac('sha256', $username . time(), 'secret');