Nonce

True\Nonce generates short, alphanumeric, one-time tokens — useful for CSRF protection, password-reset links, idempotent API requests, and anywhere else you need a unique throwaway string.

Default usage

Static create() returns a 32-character token made up of upper/lower letters and digits:

$nonce = \True\Nonce::create();
echo $nonce;
// => mccscc8KfrdzJfJvMfVwdXg2Upyzlbwo

Custom length

Pass the desired length as the first argument:

$nonce = \True\Nonce::create(16);
echo $nonce;
// => 5UWQa9397dO91RdG

Custom timestamp

The generator hashes the current time into the output to keep it unique across requests. You rarely need to override that, but the second argument accepts an explicit unix timestamp — useful in tests where deterministic output matters:

$nonce = \True\Nonce::create(32, 1660338149);

How it works

The algorithm is adapted from OpenID's nonce implementation: pseudo-random bytes are combined with a hash of the current timestamp and re-encoded into the 62-character alphanumeric alphabet. That makes collisions extremely unlikely even at small lengths, while keeping the output URL-safe and easy to log.