Yep. But they are hex strings that look like (are) hashes, and that's all I need to make the point. Next time I'll use /dev/urandom for that :)

In a real scenarios, use PBKDF2 or bcrypt!