bcrypt is not a password generation (or password stretching) algorithm. As always, it's the programmer's duty to investigate the RNG before relying on the entr

bcrypt is not a password generation (or password stretching) algorithm. As always, it's the programmer's duty to investigate the RNG before relying on the entropy of some function's result. UUIDs based on a CSPRNG and used as a password/token have some nice features--they're of fixed length, easy to validate for well-formedness, easy to serialize or deserialize in a variety of conventions.