Should I generate a digit confirmation code in my web application using java.util.Random class?

Should I generate a digit confirmation code in my web application using java.util.Random class to send it to the user's phone number? If it is not a good practice, how should i make it?