I just came across this question, but it does not really answer my main concern that I have regarding password tokens.
To authenticate a client who is not logged in; I generate two random tokens and then use one as the DB selector, the other one as the validator, to authenticate an unknown client for a given operation, like resetting a password, etc.
My question is not regarding the generation of the hashes, that's all done. The thing is that I've been told to attach the base64 representation of the hashes to the reset password or whatever URL. Because it uses less space / is more efficient than HEX. That of course is true, but isn't that more dangerous for brute-force attacks, if you use a base64 string, which is shorter?