diff --git a/lib/private/util.php b/lib/private/util.php
index c5483c1654..e1b315b1b0 100755
--- a/lib/private/util.php
+++ b/lib/private/util.php
@@ -879,7 +879,7 @@ class OC_Util {
 		$id = OC_Config::getValue('instanceid', null);
 		if (is_null($id)) {
 			// We need to guarantee at least one letter in instanceid so it can be used as the session_name
-			$id = 'oc' . \OC::$server->getSecureRandom()->getLowStrengthGenerator()->generate(10);
+			$id = 'oc' . \OC::$server->getSecureRandom()->getLowStrengthGenerator()->generate(10, \OCP\Security\ISecureRandom::CHAR_LOWER.\OCP\Security\ISecureRandom::CHAR_DIGITS);
 			OC_Config::$object->setValue('instanceid', $id);
 		}
 		return $id;
diff --git a/tests/lib/util.php b/tests/lib/util.php
index 8964f9f266..999c62486a 100644
--- a/tests/lib/util.php
+++ b/tests/lib/util.php
@@ -116,7 +116,10 @@ class Test_Util extends PHPUnit_Framework_TestCase {
 
 	function testGetInstanceIdGeneratesValidId() {
 		OC_Config::deleteKey('instanceid');
-		$this->assertStringStartsWith('oc', OC_Util::getInstanceId());
+		$instanceId = OC_Util::getInstanceId();
+		$this->assertStringStartsWith('oc', $instanceId);
+		$matchesRegex = preg_match('/^[a-z0-9]+$/', $instanceId);
+		$this->assertSame(1, $matchesRegex);
 	}
 
 	/**