diff --git a/src/collections/operations/create.js b/src/collections/operations/create.js
index 6b8234cd3c..00c86edc5a 100644
--- a/src/collections/operations/create.js
+++ b/src/collections/operations/create.js
@@ -1,4 +1,5 @@
 const mkdirp = require('mkdirp');
+const crypto = require('crypto');
 
 const executeAccess = require('../../auth/executeAccess');
 
@@ -144,7 +145,7 @@ async function create(args) {
     }
     if (collectionConfig.auth.emailVerification) {
       data.verified = false;
-      data.verificationToken = 'asdf'; // TODO: Use bcrypt
+      data.verificationToken = await crypto.randomBytes(20).toString('hex');
       // TODO: Generate and send email
     }
   }