mt_rand()

The mt_rand() function in PHP generates a random integer using the Mersenne Twister algorithm. This page covers its syntax and parameters, how it differs from the older rand(), how to seed it for reproducible results, and when you should reach for a cryptographically secure alternative instead.

What the mt_rand() Function Does

mt_rand() returns a pseudo-random integer. "Pseudo-random" means the numbers come from a deterministic algorithm seeded by an internal state — they look random, but the same seed always produces the same sequence. The Mersenne Twister algorithm it uses produces higher-quality, more evenly distributed numbers than the libc generator behind the older rand(), and it has an extremely long period (it won't repeat for 2^19937 − 1 values).

Note that mt_rand() is not cryptographically secure: if the internal state is known or recoverable, future values can be predicted. For passwords, tokens, salts, or anything security-sensitive, use random_int() instead.

Syntax

mt_rand(): int
mt_rand(int $min, int $max): int

Return value: a random integer between $min and $max inclusive, or between 0 and mt_getrandmax() when called with no arguments. If $min is greater than $max, PHP emits a warning and returns false.

How to Use the mt_rand() Function

Call it with two arguments to pick a number from an inclusive range, or with none to get a value across the full range:

The first call restricts the output to the range 1–100; the second spans the full range, whose upper bound you can inspect with mt_getrandmax() (commonly 2147483647).

Common Use Cases

Simulate a dice roll:

<?php
$roll = mt_rand(1, 6);
echo "You rolled a $roll\n";
?>

Pick a random element from an array by generating a valid index:

<?php
$colors = ['red', 'green', 'blue', 'yellow'];
$pick = $colors[mt_rand(0, count($colors) - 1)];
echo "Random color: $pick\n";
?>

Using count($colors) - 1 as the upper bound is important: array indexes are zero-based, so a four-element array has valid indexes 0–3. (For this specific job, array_rand() is a more direct option.)

Seeding for Reproducible Results

Because Mersenne Twister is deterministic, seeding it with mt_srand() makes the sequence repeatable — useful for tests, simulations, or any time you need the "random" output to be the same on every run:

<?php
mt_srand(42);
echo mt_rand(), "\n";   // same value every run for seed 42

mt_srand(42);           // reset to the same seed
echo mt_rand(), "\n";   // identical to the line above
?>

Without an explicit seed, PHP auto-seeds the generator, so you get different output each run.

Secure Alternative: random_int()

When the randomness must not be guessable — session tokens, password-reset codes, API keys — mt_rand() is the wrong tool. Use random_int(), which draws from the operating system's cryptographically secure source:

<?php
// Cryptographically secure integer between 1 and 100
$secure = random_int(1, 100);
echo $secure, "\n";
?>

It shares the same (int $min, int $max) signature, so swapping it in is straightforward.

mt_rand() vs. rand()

Since PHP 7.1, rand() is an alias for mt_rand() and uses the same Mersenne Twister engine, so they behave identically. On older versions rand() used the platform's weaker libc generator. Prefer mt_rand() when you want consistent, high-quality results across PHP versions.

Conclusion

mt_rand() is the go-to function for fast, good-quality pseudo-random integers in PHP. Use it for games, sampling, shuffling, and general randomization; seed it with mt_srand() when you need reproducible sequences; and switch to random_int() whenever security matters.

Practice