What is a good way to generate a password reset token? Is this even close to standard?

  generates_token_for :password_reset, expires_in: 15.minutes do
    # Last 10 characters of password salt, which changes when password is updated:
    password_salt&.last(10)
  end

Using a value that can be known externally -- because it is saved in plain text in the database, which I assume has been, will be, and is being breached -- seems like a security hole.