yii - Which is the most secure method of creating a cryptographically unique token in PHP -

i have working advice on secure option of creating token (for api) , either of them have issues going forward?

option a:

$token = bin2hex(openssl_random_pseudo_bytes(16));

or option b:

// $username - unique username user $token = hash('sha512', sha1($username.time().rand(1000, 9999)));

while question off-topic, it's interesting.

my answer: option a.

option b contains @ least 1 predictable value, $username. time() value might predictable, , rand() predictable if seed can guessed.

edited add: of course, if token not have kept secret, doesn't make difference. use user name.

O9