Short, yes, but with a significant amount of entropy for their length. In any case, what strikes me is that this approach just makes the algorithm the secret instead of the token. Are people more likely to be able to remember algorithms for transforming URLs into passwords? I tend to doubt it.