That's the more sound advice. Also, random_bytes() > openssl_random_pseudo_bytes() :P Though if you use random_compat[1] it might be the same function ;) [1]

That's the more sound advice. Also, random_bytes() > openssl_random_pseudo_bytes() :P Though if you use random_compat[1] it might be the same function ;) [1]: https://github.com/paragonie/random_compat https://github.com/paragonie/random_compat