diff --git a/core/lib/Drupal/Core/Render/PlaceholderGenerator.php b/core/lib/Drupal/Core/Render/PlaceholderGenerator.php
index e0940bf..4db796b 100644
--- a/core/lib/Drupal/Core/Render/PlaceholderGenerator.php
+++ b/core/lib/Drupal/Core/Render/PlaceholderGenerator.php
@@ -88,7 +88,7 @@ public function createPlaceholder(array $element) {
     // debugging.
     $callback = $placeholder_render_array['#lazy_builder'][0];
     $arguments = UrlHelper::buildQuery($placeholder_render_array['#lazy_builder'][1]);
-    $token = hash('crc32b', serialize($placeholder_render_array));
+    $token = hash('sha256', serialize($placeholder_render_array));
     $placeholder_markup = '<drupal-render-placeholder callback="' . $callback . '" arguments="' . $arguments . '" token="' . $token . '"></drupal-render-placeholder>';
 
     // Build the placeholder element to return.
diff --git a/core/modules/filter/src/FilterProcessResult.php b/core/modules/filter/src/FilterProcessResult.php
index 90e46aa..239c74d 100644
--- a/core/modules/filter/src/FilterProcessResult.php
+++ b/core/modules/filter/src/FilterProcessResult.php
@@ -142,7 +142,7 @@ public function createPlaceholder($callback, array $args) {
     $attributes = new Attribute();
     $attributes['callback'] = $callback;
     $attributes['arguments'] = UrlHelper::buildQuery($args);
-    $attributes['token'] = hash('sha1', serialize([$callback, $args]));
+    $attributes['token'] = hash('sha256', serialize([$callback, $args]));
     $placeholder_markup = Html::normalize('<drupal-filter-placeholder' . $attributes . '></drupal-filter-placeholder>');
 
     // Add the placeholder attachment.
diff --git a/core/tests/Drupal/Tests/Core/Render/RendererPlaceholdersTest.php b/core/tests/Drupal/Tests/Core/Render/RendererPlaceholdersTest.php
index d32ba5a..95a6ae7 100644
--- a/core/tests/Drupal/Tests/Core/Render/RendererPlaceholdersTest.php
+++ b/core/tests/Drupal/Tests/Core/Render/RendererPlaceholdersTest.php
@@ -69,7 +69,7 @@ public function providerPlaceholders() {
       if (is_array($cache_keys)) {
         $token_render_array['#cache']['keys'] = $cache_keys;
       }
-      $token = hash('crc32b', serialize($token_render_array));
+      $token = hash('sha256', serialize($token_render_array));
       // \Drupal\Core\Render\Markup::create() is necessary as the render
       // system would mangle this markup. As this is exactly what happens at
       // runtime this is a valid use-case.
@@ -616,7 +616,7 @@ public function testCacheableParent($test_element, $args, array $expected_placeh
 
     $this->setUpRequest('GET');
 
-    $token = hash('crc32b', serialize($expected_placeholder_render_array));
+    $token = hash('sha256', serialize($expected_placeholder_render_array));
     $placeholder_callback = $expected_placeholder_render_array['#lazy_builder'][0];
     $expected_placeholder_markup = '<drupal-render-placeholder callback="' . $placeholder_callback . '" arguments="0=' . $args[0] . '" token="' . $token . '"></drupal-render-placeholder>';
     $this->assertSame($expected_placeholder_markup, Html::normalize($expected_placeholder_markup), 'Placeholder unaltered by Html::normalize() which is used by FilterHtmlCorrector.');