uniqid()

The PHP uniqid() function generates a string ID derived from the current time in microseconds. This page explains its syntax and parameters, what the returned value actually looks like, the all-important caveat that it is not suitable for security tokens, and what to use instead.

What uniqid() does

uniqid() returns a 13-character hexadecimal string based on the system's current time, measured down to the microsecond. Because the clock keeps advancing, two calls made even a fraction of a second apart usually produce different values, which makes the function handy for low-stakes identifiers such as temporary file names, cache keys, or DOM element IDs.

It is a time-based identifier, not a random one. That distinction matters: the value is predictable, and on a fast machine two calls in the same microsecond return the same string. Keep this in mind before relying on it for uniqueness — and never for secrecy.

Syntax

uniqid(string $prefix = "", bool $more_entropy = false): string

Return value: a string. With default arguments it is 13 characters long; with $more_entropy set to true it is 23 characters (the prefix length is added on top of both).

Basic usage

Call uniqid() with no arguments to get a bare timestamp-based ID:

The returned $id is 13 hexadecimal characters. Each run prints a different value because the underlying microsecond timestamp has moved on.

Adding a prefix

Pass a string as the first argument to prepend it to the ID. This helps you tell apart IDs generated in different parts of your application, or on different servers:

The prefix is not random — it is added verbatim — so it does not increase uniqueness by itself. Its job is to namespace the ID.

More entropy

In a busy loop, the timestamp can repeat and you can get duplicate IDs. Setting the second argument to true appends extra characters (based on a combined linear congruential generator) to reduce that risk:

With $more_entropy enabled the result is 23 characters long. This lowers the chance of collisions but does not make the value unpredictable.

Important: uniqid() is not secure

This is the most common mistake with uniqid(). Because the value is derived from the clock, an attacker who knows roughly when an ID was created can guess it. Never use uniqid() for:

• password-reset tokens or "magic link" tokens
• session identifiers or API keys
• CSRF tokens or any other security-sensitive value

For anything that must be unpredictable, use a cryptographically secure source. random_bytes() (PHP 7+) is the right tool, optionally turned into a readable string with bin2hex():

<?php
// 32-character, cryptographically secure random token
$token = bin2hex(random_bytes(16));
echo "Secure token: " . $token . "\n";
// e.g. Secure token: 93261fb1d3d843e8dac1d3372b4f3306
?>

If you need a globally unique identifier in a standard format, a UUID (via a library such as ramsey/uuid) is usually a better fit than uniqid().

When to reach for uniqid()

uniqid() is a good fit when you need a quick, throwaway label and a small collision risk is acceptable:

• temporary upload or cache file names
• unique HTML id attributes generated server-side
• short-lived keys in non-security-critical caches

For unpredictable secrets use random_bytes(); for general-purpose randomness see mt_rand() and rand(); and if you only need the underlying high-resolution timestamp, look at microtime().

Summary

The uniqid() function produces a 13-character (or 23 with $more_entropy) ID from the current microsecond timestamp. It is convenient for non-sensitive, low-collision identifiers, but it is predictable by design — for security tokens always prefer random_bytes(). Choosing the right tool for the job keeps your IDs both unique enough and, where it matters, impossible to guess.

Practice