<?php
// The Secure engine is the default, but we make it explicit, because
// multi-factor codes are security sensitive.
$randomizer = new \Random\Randomizer(new \Random\Engine\Secure());
echo implode('-', str_split($randomizer->getBytesFromString('0123456789', 20), 5));
?>
The above example will output
something similar to: