It's both. The strpos() check is what you're describing, but openssl_random_pseudo_bytes() accepts an optional second by-reference argument and sets it to true

It's both. The strpos() check is what you're describing, but openssl_random_pseudo_bytes() accepts an optional second by-reference argument and sets it to true or false depending on the behavior of RAND_pseudo_bytes(). https://www.php.net/openssl_random_pseudo_bytes https://www.php.net/openssl_random_pseudo_bytes This function also isn't fork-safe in PHP, and has caused RNG collisions before: https://github.com/ramsey/uuid/issues/80 https://github.com/ramsey/uuid/issues/80 Consequently, I advise against using this function entirely. random_bytes() is better in every way.