Summary

The md5(), sha1() and sha256() generators are documented to return a random MD5, SHA-1 or SHA-256 hash respectively. This is technically true, but at the same time it's also misleading, because the functions are unable to leverage the full output space of the respective hashes the way they're written. They don't return a random hash, they return the hash of a random 32 bit integer which is something entirely different.

I'm skipping the remainder of the template, because the issue is evident by looking at the code:

Possible solution:

Replace the implementation by bin2hex(random_bytes($bytes)) with $bytes being 16, 20 and 32 to make use of the entire output space [1]. But even then it would be slightly misleading, because hexadecimal is just one possible encoding for an 128/160/256 bit integer. Returning raw bytes or base64 encoding would also be valid representations that are actually used in practice in the context of a cryptographic hash.

[1] With PHP 8.2 use Randomizer::getBytes().