URL-safe pseudorandom string generator in C#
const string TOKENALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-.";



I learnt the hard way that the problem with using . in a URL token sent by e-mail is that certain mail clients (Outlook in particular) will attempt to auto-detect URLs in a plain text email, but will exclude a trailing . from the inferred URL, so when your user clicks on the auto-generated link they send an invalid token. I suggest that you change . to _.




    static string NewToken(int length = 16)



Length in what units? Generally with cryptographic stuff it's clearer to explicitly use bits as the unit of length.




        var rnd = new RNGCryptoServiceProvider();



As already noted in comments, this is IDisposable and the standard using pattern is preferred.




        var token =
            Enumerable
                .Range(0, length)
                .Select(i =&gt; TOKENALPHABET[tokenBytes[i] % TOKENALPHABET.Length])
                .ToArray();



Firstly, this could be simplified to

        var token =
            tokenBytes
                .Select(b =&gt; TOKENALPHABET[b % TOKENALPHABET.Length])
                .ToArray();


But secondly, by only using 6 bits per byte you're throwing away 25% of the entropy which the system just produced for you. On busy servers, cryptographic-grade entropy is a valuable resource and you should only request as much as you need.