Does mt_rand() generate same number twice?

Question

I am trying to generate unique token id, can i use mt_rand() ?

will mt_rand() generate same number twice?

Answer 1

This is the first time ever I'm going to answer a question with just a comic , just because it's the right answer:

The original on Dilbert.com .

Answer 2

mt_rand will generate the same number twice, yes. Every random number generator will probably do so eventually. (Theoretically) every number has the same chance of being generated every time the generator is run. It could randomly generate the same number many times in a row. It's random.

To use a random number generator for unique ids, the probability of generating the same number twice must be so low as to be irrelevant in practice. In this regard, mt_rand is probably not sufficient. The concept of randomly generated unique ids has been formalised into UUIDs , which you should use for exactly the purpose of a universally unique id .

Take this quote :

...only after generating 1 billion UUIDs every second for the next 100 years, the probability of creating just one duplicate would be about 50%.

Since mt_rand returns a 32-bit integer on 32-bit systems, it can only return 2^32 unique values, which is a mere 4,294,967,296 unique values. If you were generating a billion mt_rand values every second, you're basically guaranteed a duplicate after 4 seconds. That hopefully illustrates the difference of scale between UUIDs and mt_rand and why that matters. Even if you're generating much fewer than 1 billion ids every second, you'll still need to choose an algorithm which makes collisions practically impossible, not just unlikely.

Answer 3

mt_rand() will return a random number on each call.

But eventually, it will return numbers that have already been returned to you. That is because, along with being consistent with desired statistical properties of randomness, the generator has a finite (although for Mersenne Twister, a very large) periodicity . If this behaviour is undesirable then your best bet is to shuffle a unique set using that generator.

Answer 4

mt_rand() has the following caveats:

Caution : This function does not generate cryptographically secure values, and should not be used for cryptographic purposes. If you need a cryptographically secure value, consider using openssl_random_pseudo_bytes() instead.

And

Caution : The distribution of mt_rand() return values is biased towards even numbers on 64-bit builds of PHP when max is beyond 2^32.

If you're fine with it not being completely unbiased, you should be ok.

But, if that's the case, why aren't you using uniqid ?