Weave Code
Seeded, deterministic random number generator
Frequently asked questions about Seedspring
- What is paragonie/seedspring and what is it used for?
- Seedspring is a small, framework-agnostic PHP library that provides a seeded, deterministic pseudo-random number generator backed by AES-256-CTR instead of a linear congruential generator. You give it a seed and it produces the same byte stream, integers, floats, and shuffles on every run. In a Laravel app it fits reproducible test fixtures, deterministic demo or tenant seed data, and simulations where rerunning a draw must return the same result. It is not a replacement for cryptographically secure randomness in security-sensitive features.
- How do I install paragonie/seedspring in a Laravel project?
- Install it with composer require paragonie/seedspring. The package ships no service provider, facade, or config file, so integration is a thin wrapper of your own: define an interface, bind an implementation in a service provider, and inject it where reproducible randomness is needed. Budget design time for seed derivation and binding lifetime rather than expecting it to drop in like a first-party package. Confirm the exact method surface and minimum PHP version at install time.
- Is seedspring safe for API tokens, CSRF tokens, or password reset links?
- No. Deterministic output is the opposite of what those features need, because anyone who learns the seed can reconstruct the entire stream, past and future. Keep Laravel's secure random helpers, such as Str::random and random_int, for tokens, session identifiers, CSRF, password resets, and any prize or gift-card draw with real value. Enforce that boundary in architecture, for example by keeping the generator behind a narrowly named interface that is never injected into auth or payment code.
- How is seedspring different from seeding Faker or calling mt_srand in Laravel tests?
- Faker seeding covers fake data generation, and mt_srand affects PHP's Mersenne Twister, which is unsuitable for anything sensitive and does not give you a documented byte stream. Seedspring gives you an explicit generator object with methods for bytes, integers, ranges, floats, and shuffles, all driven by AES-256-CTR from your seed. That makes the output stream easier to reason about and pin in golden-file tests. The trade-off is that you own the reproducibility contract yourself.
- Which PHP and Laravel versions does seedspring support?
- Seedspring is framework-agnostic, so it is not tied to a Laravel release, but confirm its required PHP version and public method surface against your runtime, such as PHP 8.2, 8.3, or 8.4, at install time rather than assuming. Laravel 10, 11, and 12 projects can all use it through a thin wrapper. Because there is no framework integration, there is nothing to keep in sync with Laravel upgrades beyond your own binding.
- How should I register seedspring in Laravel's service container?
- Register it as a scoped or transient binding rather than a singleton, because the generator advances its internal state on every call. Under Octane, Horizon, or long-running queue workers, a singleton would carry one request's stream position into the next request, silently breaking reproducibility and potentially crossing tenant boundaries. If you need a shared instance, resolve a fresh generator per job or per request and pass it explicitly.
- Can I use seedspring in Laravel factories and database seeders?
- Yes, that is one of its strongest fits. Use a fixed seed in factories and seeders when you need byte-for-byte reproducible fixtures, snapshot tests, or demo data that replays identically across environments. Keep the seed stable per fixture set so generated records do not churn between runs. Avoid using it for real production user data unless reproducibility is a documented requirement.
- Where should I store the seed used by seedspring?
- Treat the seed as a secret for any non-test use and keep it in your secret manager, not in .env.example, config defaults, or repository code. Decide who owns the seed material and document a rotation story, because changing a seed changes every downstream output. For tests, a hardcoded constant seed in the test suite is fine and often preferable.
- How do I keep seedspring output stable across refactors?
- Write a regression test that pins the exact output for a known seed, and treat any change to it as a contract break rather than a test to update casually. The guarantee depends on call ordering: adding an extra nextInt or reordering a shuffle consumes different bytes and changes every later value without raising an error. Because the package does not document a version-pinned output guarantee, the contract is yours to define, test, and review.
- What are the maintenance and supply chain risks of using seedspring?
- It is a small, single-maintainer package with modest adoption, so record an approved-vendor or exception decision before it reaches a regulated or customer-facing path. The algorithm is sound and the surface area is small enough to fork and vendor if upstream stalls. Pin the version in composer.lock, monitor releases, and keep your wrapper interface thin so replacing the implementation later is cheap.
Weaver
How can I help you explore Laravel packages today?