You get a degree of cryptographic security by using a sufficiently large and random token - ie, attackers computers cannot spam guesses fast enough to get a hit

You get a degree of cryptographic security by using a sufficiently large and random token - ie, attackers computers cannot spam guesses fast enough to get a hit in any reasonable amount of time. I can’t remember what the exact requirements are though.