NanoID generator: short URL-safe identifiers

How strength is calculated

NanoID entropy is the length multiplied by the logarithm of the alphabet size. By default it is 21 characters from a set of 64: 21 × log₂64 = 126 bits. That is roughly the same as UUID v4, but the string is 15 characters shorter. Reduce the length to 10 and you get 60 bits: still acceptable for public identifiers, no longer acceptable for invitations to a closed system.

Characters are picked uniformly: values from the generator are rejected if they could bias the result toward the start of the alphabet. That is why "digits come up more often" does not happen here.

Which alphabet to choose

URL-safe is the universal option: A–Z, a–z, 0–9, hyphen and underscore need no percent-encoding in addresses. Letters and digits without hyphens are more convenient when the identifier is typed by hand. Digits only will do for short confirmation codes, but keep in mind: a 10-character alphabet cuts entropy by roughly six times per character. A custom set helps when an external system demands a specific format.

What NanoID cannot do

It carries no time, so sorting by identifier gives no chronology. And it is no substitute for a password: an identifier should not grant access on its own, permissions are checked by the server. For sortable keys there is UUID v7 and ULID, for passwords a dedicated generator.

All values are generated locally via crypto.getRandomValues. Duplicates are practically excluded, but as with any random identifier the probability is not zero.