// mt_rand() is seeded from the clock and is not for this.
$alphabet = 'abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789';
$bytes = openssl_random_pseudo_bytes(12);
$password = '';
for ($i = 0; $i < 12; $i++) {
$password .= $alphabet[ord($bytes[$i]) % strlen($alphabet)];
}