<?php

function generateToken(): string
{
    $bytes = false;
    if (function_exists('openssl_random_pseudo_bytes') && 0 !== stripos(PHP_OS, 'win')) {
        $bytes = openssl_random_pseudo_bytes(32, $strong);

        if (true !== $strong) {
            $bytes = false;
        }
    }

    // let's just hope we got a good seed
    if (false === $bytes) {
        $bytes = hash('sha256', uniqid((string) mt_rand(), true), true);
    }

    return base_convert(bin2hex($bytes), 16, 36);
}

echo generateToken();
