I know this is an old topic, but there is also random_bytes, which has its output marked as sensitive per documentation:

resource "random_bytes" "this" {
  length = 32
}

you can then get the value as base64 or as hex:

random_bytes.this.hex

random_bytes.this.base64