random_key base 62

random_hash_b62

<?php
/*
 * Copyright 2011, Tim Kuijsten
 * Released under the MIT license.
 * http://creativecommons.org/licenses/MIT/
 */

/**
 * Generate a random string of base 62 characters [a-zA-Z0-9].
 *
 * @param int $str_length  minimum of 2
 * @return string          base 62 string of length $str_length
 */
function random_key($str_length = 24)
{
  // base 62 map
  $chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';

  // get enough random bits for base 64 encoding (and prevent '=' padding)
  // note: +1 is faster than ceil()
  $bytes = openssl_random_pseudo_bytes(3*$str_length/4+1);

  // convert base 64 to base 62 by mapping + and / to something from the base 62 map
  // use the first 2 random bytes for the new characters
  $repl = unpack('C2', $bytes);

  $first  = $chars[$repl[1]%62];
  $second = $chars[$repl[2]%62];

  return strtr(substr(base64_encode($bytes), 0, $str_length), '+/', "$first$second");
}

You were completely right about the entropy and replacement shortcomings. Furthermore it definitely isn't an url hashing function. I use it to create unique url's, sorry if I mislead you.

I updated the code to use more entropy and from a better source. The new function is about 8% to 9% slower but scales really well to large truly random base 62 keys (a lot more than the original 11 character keys that were padded to at most 22 characters ;-).