rand()

The rand() function in PHP generates a pseudo-random integer. This chapter covers its syntax, how the optional range arguments work, the difference between rand() and the faster mt_rand(), why you should never use either one for security, and a few practical patterns like rolling a die or picking a random array element.

What the rand() Function Does

rand() is a built-in PHP function that returns a random integer. With no arguments it returns a value between 0 and getrandmax() (the largest value the generator can produce — at least 32767). When you pass a $min and $max, it returns an integer in the inclusive range $min ≤ n ≤ $max.

It produces pseudo-random numbers: values that look random but are generated by a deterministic algorithm from an internal seed. That is fine for games, sampling, and test data, but not for anything where predictability is a risk (see Security below).

Syntax

rand(): int
rand(int $min, int $max): int

$min and $max are inclusive, so rand(1, 6) can return 1, 6, or anything between. If you pass $min greater than $max, PHP 8 throws a ValueError.

Basic Usage

Here we call rand() with a range, store the result in $result, and print it. Run the example a few times and you will get a different number each run.

Common Use Cases

A few patterns you will reach for often:

<?php
// 1. Roll a six-sided die
$die = rand(1, 6);

// 2. Pick a random element from an array
$colors = ['red', 'green', 'blue'];
$color  = $colors[rand(0, count($colors) - 1)];

// 3. A coin flip
$side = rand(0, 1) === 0 ? 'heads' : 'tails';

echo "Die: $die, Color: $color, Coin: $side";
?>

For picking an array element, PHP also offers the dedicated array_rand() helper, which is clearer than computing the index by hand.

rand() vs mt_rand()

mt_rand() uses the Mersenne Twister algorithm. It is faster and has better statistical properties than the legacy rand(), so it is the preferred general-purpose choice. The two share the same signature:

<?php
$a = rand(1, 100);     // legacy generator
$b = mt_rand(1, 100);  // Mersenne Twister — recommended
echo "$a and $b";
?>

Since PHP 7.1, rand() is actually an alias for mt_rand() internally, so they behave the same on modern PHP. Prefer mt_rand() in new code for clarity. Its companion mt_getrandmax() tells you the largest value it can return.

Seeding

You can seed the generator with srand() (or mt_srand() for mt_rand()). Seeding with a fixed value makes the sequence reproducible — handy for tests:

<?php
srand(42);
echo rand(1, 100), "\n"; // same output every run for seed 42
?>

Since PHP 4.2 you almost never need to call srand() manually — PHP seeds the generator automatically on first use.

When Not to Use rand()

rand() and mt_rand() are not cryptographically secure. Their output is predictable, so never use them for passwords, tokens, session IDs, password-reset links, or anything security-sensitive. For those, use a CSPRNG:

<?php
$secureInt   = random_int(1, 100);     // cryptographically secure integer
$secureBytes = random_bytes(16);       // 16 random bytes
echo $secureInt, ' ', bin2hex($secureBytes);
?>

random_int() has the same (min, max) signature as rand(), so it is usually a drop-in replacement when security matters.

Summary

• rand($min, $max) returns a pseudo-random integer in an inclusive range; with no arguments it spans 0 to getrandmax().
• Prefer mt_rand() for general use — it is faster and better distributed (and rand() is an alias for it since PHP 7.1).
• Use random_int() / random_bytes() whenever the value must be unpredictable.

For more on numeric values and math helpers, see PHP Numbers and PHP Math.

Practice