A random-looking identifier and a secret token solve different problems. For a record ID, collision resistance may be enough; for a reset link or API credential, the value must also be unpredictable to an attacker. Use a cryptographically secure generator for secrets, not timestamps, Math.random(), or a phrase you invented.
Choose enough length for the purpose, make each secret single-use when possible, and set an appropriate expiry. Keep tokens out of analytics, logs, and URL sharing previews. Store a hash of a verification token when the application only needs to check it later. The password generator is useful for human account passwords; a UUID is not a replacement for a carefully designed access token.
Akousa