New comment on reddit

Yeah. Best advice is "use the generator that ships with your password manager."

Yep 🙂

Well, you could log the generated passwords and pair them with the IP that made the request. This greatly narrows down the search space if you know who owns the IP address, even if you don't know exactly which generated password they used.

I guess … but that'd be an awful lot of work 🙂

It should be noted that PHP 5.6 ended support December 2018, even though Debian 8.0 has extended it until June 2020.

It's running on a CentOS 7 box – because most of what I do I want to work on the same OSes I see at work (most often RHEL)

Probably wouldn't hurt to jump it to PHP7 – with the caveat that it won't run on older OSes without extra package repos available

Thanks for the feedback!