When I was younger I used to have my users’ passwords generated by something like:
$password = "sitename".rand(1,999);
Now as you can guess this was not the most secure way to do it. So I tried something a bit more secure:
$password = "sitename".rand(1,999999);
Now it was unlikely the user would brute force trying to guess passwords. This time around I wanted something more secure. A google search of “PHP random generated passwords” lead me to many bloated functions like this one.
So I wrote this one, much cleaner in my opinion:
function password ($length) {
if ($length > 32) $length = 32;
if ($length < 1) $length = 1;
return substr(md5(uniqid(rand(), true)), rand(0,32-$length), $length);
}
The only downside to this I can see is that since it uses md5 it is limited to 32 characters. I am sure switching it up with sha1 would make it possible to have passwords of length 40.