Nice (y), I'd just leave out the substr() call and use the full output of the sha1(). Using just a part of the output might damage the algo and lead to collisions which might not be a real deal here, but still.

To make the token shorter use
`return $random . base64_encode(hash('sha1', $this->getRawToken() . $random, true));`

which gives 10 + 28 chars total.