Secure random hexadecimal size in bits to prevent brute-force

I'm getting hexadecimal digits to generate unique random activators link, such as:

hostname/account/confirm/$randomHex

By searching, actually, my random hex using PHP could be:

bin2hex( openssl_random_pseudo_bytes(16) )

Above generates a string with 32 hex digits and i would appreciate to use a less length as 12 hex digits.

Considering the power processing of computers, what's the more secure minimum size of the hexadecimal that i'm able to use?