Weave Code
Secure Random Laravel Package
php-standard-library/secure-random
SecureRandom provides cryptographically secure random bytes and strings in PHP for tokens, passwords, nonces, and IDs. Simple API built on secure system sources, suitable for authentication, session, and security-sensitive workflows.
Cryptographically secure random data generation for tokens, passwords, and nonces
Frequently asked questions about Secure Random
- How do I install php-standard-library/secure-random in a Laravel application?
- Install it with Composer using composer require php-standard-library/secure-random, then check the package composer.json for its PHP version requirement. Laravel does not need a service provider or configuration step. You can instantiate SecureRandom directly or bind it as a singleton in Laravel's container for injection.
- Does SecureRandom work with Laravel 10 and Laravel 11?
- The package is framework-agnostic and has no Laravel-specific dependencies, so Laravel version compatibility is mainly a matter of PHP version support. Check the package composer.json and documentation for the required PHP version before upgrading. In most Laravel apps it can be adopted without changing framework configuration.
- Is SecureRandom a drop-in replacement for Laravel Str::random()?
- For security-critical tokens, yes: SecureRandom::hex(32) gives you an explicit cryptographically secure alternative to Str::random(32). Laravel's Str::random() also uses secure randomness in modern versions, but SecureRandom makes the security intent and output format clearer. You can migrate gradually because the package is additive and does not change existing Str::random() calls.
- Do I need a service provider or facade to use SecureRandom in Laravel?
- No. The package is intentionally minimal and does not require a service provider, facade, migration, or config file. If you want dependency injection, bind SecureRandom as a singleton in a service provider and resolve it through the container. A custom facade is optional and only useful if you want a standardized internal API.
- What authentication and security use cases does SecureRandom cover in Laravel?
- Use it for JWT secrets, OAuth state tokens, password reset links, CSRF tokens, nonces, IVs, and unpredictable IDs. It is also useful anywhere you would otherwise reach for mt_rand(), uniqid(), or ad-hoc random strings. It generates random data, not password hashes, so continue using Laravel's Hash facade for password storage.
- Is SecureRandom safer than mt_rand() or uniqid() for tokens?
- Yes. mt_rand() and uniqid() are not cryptographically secure and should not be used for authentication, session, CSRF, or other security-sensitive values. SecureRandom is built on secure system sources and is intended as a direct replacement for insecure randomness in Laravel code. Treat any legacy mt_rand() or uniqid() token generation as a migration candidate.
- How do I test Laravel code that uses SecureRandom with PHPUnit?
- Wrap SecureRandom behind your own service or bind it in Laravel's container so tests can substitute a fake implementation. The package is also easy to mock by stubbing random_bytes() in unit tests. Keep production code on the real CSPRNG and reserve deterministic fakes for test scenarios.
- What production concerns should I check before using SecureRandom in Laravel?
- Cryptographic randomness is slower than mt_rand(), so benchmark token generation under your expected load, especially if you generate high-volume CSRF or API tokens. In containers, CI, or low-entropy environments, monitor the system entropy source and verify that random_bytes() is not falling back to a weaker source. Cache tokens where appropriate, but do not weaken randomness for security-sensitive values.
- Should I use SecureRandom::uuid() instead of Ramsey\Uuid in Laravel?
- Use SecureRandom::uuid() when your main requirement is an unpredictable UUID-like identifier for security-sensitive records or public IDs. Use Ramsey\Uuid if you need full RFC-compliant UUID features, database integration, or UUID version-specific behavior. Evaluate both against your database schema and ID predictability requirements before standardizing.
- Is php-standard-library/secure-random maintained, and what are the alternatives?
- The package is intentionally small and additive, but you should verify its release history and issue activity before adopting it for long-term production use. Alternatives include PHP's random_bytes() and random_int() directly, Laravel's Str::random() for secure random strings, and Ramsey\Uuid for UUID workflows. Because SecureRandom has no Laravel-specific dependencies, it can be treated as a small static library or forked if maintenance becomes a concern.
Weaver
How can I help you explore Laravel packages today?