NanoID Generator

Short random IDs are a convenient way to name things: a URL slug, a coupon code, a row key, a file name. The design question is always the same: how long must the ID be, and which characters may it use, so that clashes never happen in practice? This page generates IDs in the style of the NanoID library and answers that question with numbers for your own settings.

How an ID is made

You choose a length and an alphabet. For each position, the generator takes a random byte from the browser’s secure random source, keeps only the low bits so the value falls into a power-of-two range that covers the alphabet, and uses it if it points to a real character; otherwise the byte is thrown away and another is drawn. This rejection step is what keeps every character equally likely. A simple remainder operation would favour the first characters whenever the alphabet size does not divide 256.

Alphabets

The default alphabet has 64 characters: the digits, the upper-case and lower-case letters, and the underscore and hyphen, all safe in URLs. The other presets are letters and digits (62 characters), lower-case letters and digits (36), digits only (10), hexadecimal (16) and an alphabet that leaves out 0, O, 1, l and I so that codes read aloud or typed from paper are not misread. Choosing “My own characters” lets you type any set of 2 to 256 different characters, and repeated characters are removed.

Strength and the birthday problem

Each position adds log2(alphabet size) bits. The default 21 characters from 64 give 126 bits. To judge the risk of two IDs being equal you need the birthday approximation: with N possible IDs, the probability of at least one duplicate among n IDs is about n squared divided by 2N, so clashes appear far sooner than the total space suggests. The panel computes this for the number of IDs you create per day over a year, and also the number of IDs after which the chance of a duplicate reaches 1 percent.

Choosing a length

For the default 21-character ID, creating a million a day for a year gives a duplicate chance of about 7.83 × 10⁻²², and you would need roughly 1.31 × 10¹⁸ IDs to reach a 1 percent chance. A short ID tells a different story. Eight characters from the 36-character lower-case alphabet give 41.4 bits, and a million IDs already carry a clash probability of about 16 percent, with a 1 percent chance after only 238,000. Short IDs are fine when the application checks for duplicates and retries, as a database unique constraint allows.

A worked example

With the default settings, pressing Generate produces five 21-character IDs, each made only of A–Z, a–z, 0–9, _ and -. The strength line reads 126.0 bits and the alphabet size 64 characters. Changing the alphabet to digits only and the length to 6 gives a million possible codes, 19.9 bits, and a quick look at the panel shows why such codes need a duplicate check and an expiry.

Limits

The estimate assumes that IDs are random and independent, which the generator ensures, and it ignores any structure of your own system. The tool produces random IDs, not ordered ones, and not IDs that carry meaning. It is a generator for examples, tests and one-off needs; production systems should generate IDs on the server with a vetted library. The page makes no network requests, and generated IDs are not saved.

Related tools

• UUID Generator makes standard 128-bit identifiers.
• ULID Generator produces IDs that sort by creation time.
• Hash Generator computes digests when you need a fingerprint, not a random ID.
• ObjectId Decoder reads the parts of a MongoDB id.