CryptographicToken

A thin wrapper over PHP's random_bytes() — the CSPRNG the rest of Clarity's security primitives build on (Session::start(), Csrf's tokens, and anywhere else a value must not be guessable).

Methods

CryptographicToken::generate(int $bytes = 32): string
// hex-encoded — the returned string is $bytes * 2 characters long

CryptographicToken::generateUrlSafe(int $bytes = 32): string
// base64url (RFC 4648 §5, unpadded) — safe in a URL or cookie with no further encoding

CryptographicToken::generate();            // 64-char hex string (32 bytes)
CryptographicToken::generateUrlSafe(16);    // 22-char base64url string (16 bytes)

Next steps

• Session — the main consumer, for session tokens.
• HMAC — signing a token's payload rather than just generating a random one.