Yes, it needs to be as unpredictable as possible. Usually this sort of code is already present and well tested in whatever web framework you're using and there

Yes, it needs to be as unpredictable as possible. Usually this sort of code is already present and well tested in whatever web framework you're using and there's just no good reason to write it again yourself. Best case is you wasted your time, worst case it's buggy and insecure.