Late addendum: As Oleg Abrazhaev points out, if you want to make sure your system is actually capable of generating cryptographically strong random values at runtime, openssl_random_pseudo_bytes accepts a reference to a bool to report this. $random_hash = bin2hex(openssl_random_pseudo_bytes(16)) Change receipt styles, fonts or sizes quickly to customize your receipt. Use receipt maker Make customize receipts in seconds Blazing Fast Our receipt maker makes receipts in seconds. Generate receipts for FREE from your phone or laptop. The following looks just like the output of John Conde's answer, but is (supposedly) more random and less guessable: // generate a 16 byte random hex string Online Receipt Maker The world's easiest way to make receipts for customers or expenses. You can then use bin2hex() to turn it into a nice alphanumeric. If there is any concern over the possibility of a confirmation code being guessed (and that is the whole point of issuing a code) you may wish to use a more random generator such as openssl_random_pseudo_bytes(). The documentation for uniqid explicitly warns that it does not create 'random nor unpredictable strings', and states emphatically that ' This function must not be used for security purposes.' The accepted answer suggests using a hash of PHP's uniqid().

Php receipt generator