diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce55cf0d..d86cd048 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,7 @@
 # Changelog
 
+## Unreleased
+
 ## 1.16.3 - 2021-01-10
 ### Fixes
 - fix crash when using a `dict` for `path-restrict`
@@ -15,7 +17,7 @@
 - [twitter] fetch media from pinned tweets ([#1203](https://github.com/mikf/gallery-dl/issues/1203))
 - [wikiart] add extractor for single paintings ([#1233](https://github.com/mikf/gallery-dl/issues/1233))
 - [downloader:http] add MIME type and signature for `.ico` files ([#1211](https://github.com/mikf/gallery-dl/issues/1211))
-- add a `d` format string conversion for timestamp values
+- add `d` format string conversion for timestamp values
 - add `"ascii"` as a special `path-restrict` value
 ### Fixes
 - [hentainexus] fix extraction ([#1234](https://github.com/mikf/gallery-dl/issues/1234))
diff --git a/gallery_dl/extractor/instagram.py b/gallery_dl/extractor/instagram.py
index c3e7fe4b..58598db6 100644
--- a/gallery_dl/extractor/instagram.py
+++ b/gallery_dl/extractor/instagram.py
@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 
 # Copyright 2018-2020 Leonardo Taccari
-# Copyright 2018-2020 Mike Fährmann
+# Copyright 2018-2021 Mike Fährmann
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 as
@@ -35,7 +35,7 @@ class InstagramExtractor(Extractor):
         Extractor.__init__(self, match)
         self.item = match.group(1)
         self.www_claim = "0"
-        self.csrf_token = util.generate_csrf_token()
+        self.csrf_token = util.generate_token()
         self._find_tags = re.compile(r"#\w+").findall
         self._cursor = None
 
diff --git a/gallery_dl/extractor/pinterest.py b/gallery_dl/extractor/pinterest.py
index 334412d5..e5a04868 100644
--- a/gallery_dl/extractor/pinterest.py
+++ b/gallery_dl/extractor/pinterest.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright 2016-2020 Mike Fährmann
+# Copyright 2016-2021 Mike Fährmann
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 as
@@ -305,7 +305,7 @@ class PinterestAPI():
     def __init__(self, extractor):
         self.extractor = extractor
 
-        csrf_token = util.generate_csrf_token()
+        csrf_token = util.generate_token()
         self.headers = self.HEADERS.copy()
         self.headers["X-CSRFToken"] = csrf_token
         self.cookies = {"csrftoken": csrf_token}
diff --git a/gallery_dl/extractor/twitter.py b/gallery_dl/extractor/twitter.py
index b769912c..a93b6383 100644
--- a/gallery_dl/extractor/twitter.py
+++ b/gallery_dl/extractor/twitter.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright 2016-2020 Mike Fährmann
+# Copyright 2016-2021 Mike Fährmann
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 as
@@ -239,7 +239,7 @@ class TwitterExtractor(Extractor):
     def _login_impl(self, username, password):
         self.log.info("Logging in as %s", username)
 
-        token = util.generate_csrf_token()
+        token = util.generate_token()
         self.session.cookies.clear()
         self.request(self.root + "/login")
 
@@ -509,7 +509,7 @@ class TwitterAPI():
         # CSRF
         csrf_token = cookies.get("ct0", domain=cookiedomain)
         if not csrf_token:
-            csrf_token = util.generate_csrf_token()
+            csrf_token = util.generate_token()
             cookies.set("ct0", csrf_token, domain=cookiedomain)
         self.headers["x-csrf-token"] = csrf_token
 
diff --git a/gallery_dl/util.py b/gallery_dl/util.py
index ffd686ed..0f43afc8 100644
--- a/gallery_dl/util.py
+++ b/gallery_dl/util.py
@@ -71,8 +71,9 @@ def raises(cls):
     return wrap
 
 
-def generate_csrf_token():
-    return random.getrandbits(128).to_bytes(16, "big").hex()
+def generate_token(size=16):
+    """Generate a random token with hexadecimal digits"""
+    return random.getrandbits(size * 8).to_bytes(size, "big").hex()
 
 
 def combine_dict(a, b):
diff --git a/gallery_dl/version.py b/gallery_dl/version.py
index 601eeed5..347ae0a8 100644
--- a/gallery_dl/version.py
+++ b/gallery_dl/version.py
@@ -6,4 +6,4 @@
 # it under the terms of the GNU General Public License version 2 as
 # published by the Free Software Foundation.
 
-__version__ = "1.16.3"
+__version__ = "1.16.4-dev"
diff --git a/test/test_util.py b/test/test_util.py
index 159c4bc2..02858f8b 100644
--- a/test/test_util.py
+++ b/test/test_util.py
@@ -474,6 +474,20 @@ class TestOther(unittest.TestCase):
         with self.assertRaises(ValueError):
             func(3)
 
+    @unittest.skipIf(sys.hexversion < 0x3050000, "missing bytes.hex()")
+    def test_generate_token(self):
+        tokens = set()
+        for _ in range(100):
+            token = util.generate_token()
+            tokens.add(token)
+            self.assertEqual(len(token), 16 * 2)
+            self.assertRegex(token, r"^[0-9a-f]+$")
+        self.assertGreaterEqual(len(tokens), 99)
+
+        token = util.generate_token(80)
+        self.assertEqual(len(token), 80 * 2)
+        self.assertRegex(token, r"^[0-9a-f]+$")
+
     def test_combine_dict(self):
         self.assertEqual(
             util.combine_dict({}, {}),