note 111086 added to function.crypt

To generate salt use mcrypt_create_iv() not mt_rand() because no matter how many times you call mt_rand() it will only have at most 32 bits of entropy. Which you will start seeing salt collisions after about 2^16 users. mt_rand() is seeded poorly so it should happen sooner. For bcrypt this will actually generate a 128 bit salt: <?php $salt = strtr(base64_encode(mcrypt_create_iv(16, MCRYPT_DEV_URANDOM)), '+', '.'); ?> *** Bike shed *** The last character in the 22 character salt is 2 bits. base64_encode() will have these four character "AQgw" bcrypt will have these four character ".Oeu" You don't need to do a full translate because they "round" to different characters: echo crypt('', '$2y$05$.....................A') . "\n"; echo crypt('', '$2y$05$.....................Q') . "\n"; echo crypt('', '$2y$05$.....................g') . "\n"; echo crypt('', '$2y$05$.....................w') . "\n"; $2y$05$......................J2ihDv8vVf7QZ9BsaRrKyqs2tkn55Yq $2y$05$.....................O/jw2XygQa2.LrIT7CFCBQowLowDP6Y. $2y$05$.....................eDOx4wMcy7WU.kE21W6nJfdMimsBE3V6 $2y$05$.....................uMMcgjnOELIa6oydRivPkiMrBG8.aFp. ---- Server IP: 69.147.83.199 Probable Submitter: 67.175.5.197 ---- Manual Page -- http://php.net/manual/en/function.crypt.php Edit -- https://master.php.net/note/edit/111086 Del: integrated -- https://master.php.net/note/delete/111086/integrated Del: useless -- https://master.php.net/note/delete/111086/useless Del: bad code -- https://master.php.net/note/delete/111086/bad+code Del: spam -- https://master.php.net/note/delete/111086/spam Del: non-english -- https://master.php.net/note/delete/111086/non-english Del: in docs -- https://master.php.net/note/delete/111086/in+docs Del: other reasons-- https://master.php.net/note/delete/111086 Reject -- https://master.php.net/note/reject/111086 Search -- https://master.php.net/manage/user-notes.php