Any reason we're not using `openssl_random_pseudo_bytes` instead, and then encoding it under a certain base? It's cryptographically strong and cleaner than this.

See for example [uid2](https://github.com/coreh/uid2/blob/master/index.js) by @coreh as an example. Would be nice to have an equivalent PHP package.