NanoID Generator
Generate compact, URL-friendly NanoID identifiers.
What is NanoID?
NanoID is a compact, URL-friendly unique string identifier. At 21 characters, it provides similar collision resistance to UUID v4 but in a shorter, more URL-friendly format using Base64 characters.
Introduction
NanoID is the URL-friendly alternative to UUIDs — shorter, more readable, and built for the web. While a UUIDv4 is 36 characters of hyphens and hex, NanoID produces compact identifiers using a customizable alphabet of letters, digits, and symbols. A 21-character NanoID matches UUID v4's entropy in 60% less space. This tool generates cryptographically secure NanoIDs using crypto.getRandomValues(), with configurable length and character sets. If you need identifiers that fit in URLs, file names, or short codes without sacrificing security, NanoID is the modern choice.
What This Tool Does
Why It Matters
Shorter IDs mean shorter URLs, smaller database indexes, and more human-readable error messages. A 21-character NanoID with the default alphabet (A-Z, a-z, 0-9, - _) provides 126 bits of entropy — more than enough for any public identifier. NanoID's customizable alphabet lets you match your ID format to your system's constraints: URL-safe for web routes, alphanumeric for database columns, or numeric for short codes. The library has been adopted by major projects including React (for internal keys), Vue, and Next.js, making it a de facto standard for modern web application identifiers.
How It Works
Step-by-Step Examples
Set length to 21 characters — the default that matches UUID v4 entropy
Use the default alphabet: A-Z, a-z, 0-9, - _ (64 characters)
Click Generate to invoke crypto.getRandomValues() for 21 character selections
Observe the entropy: 21 × log₂(64) = 21 × 6 = 126 bits
V1StGXR8_Z5jdHi6B-myT — 126 bits of entropy, URL-safe without encodingSet length to 10 characters for a compact identifier
Use the default 64-character alphabet
Click Generate to produce a short, readable ID
Observe the entropy: 10 × log₂(64) = 60 bits — sufficient for public short codes
k9mP2xNq7r — 60 bits of entropy, suitable for URL shorteners and short codesCode Examples
const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
function generateNanoID(length = 21, alphabet = ALPHABET) {
const bytes = new Uint8Array(length);
crypto.getRandomValues(bytes);
// Rejection sampling to avoid modulo bias
const maxValid = Math.floor(256 / alphabet.length) * alphabet.length;
let id = '';
let i = 0;
while (id.length < length) {
if (bytes[i] < maxValid) {
id += alphabet[bytes[i] % alphabet.length];
}
i++;
if (i >= bytes.length) {
crypto.getRandomValues(bytes);
i = 0;
}
}
return id;
}
// Default: 21 chars, 126 bits
console.log(generateNanoID());
// Short: 10 chars, 60 bits
console.log(generateNanoID(10));
// Numeric only: 8 digits
console.log(generateNanoID(8, '0123456789'));function nanoIDEntropy(length, alphabetSize) {
const entropy = length * Math.log2(alphabetSize);
const combinations = Math.pow(alphabetSize, length);
const crackTime = combinations / 2 / 1e9; // seconds at 1B guesses/sec
return {
length,
alphabetSize,
entropyBits: entropy.toFixed(1),
totalCombinations: combinations.toExponential(2),
crackTimeSeconds: crackTime.toExponential(2),
crackTimeFormatted: formatTime(crackTime)
};
}
function formatTime(seconds) {
if (seconds < 1) return 'instant';
if (seconds < 60) return seconds.toFixed(0) + ' sec';
if (seconds < 3600) return (seconds / 60).toFixed(0) + ' min';
if (seconds < 86400) return (seconds / 3600).toFixed(0) + ' hours';
return (seconds / 86400).toExponential(1) + ' days';
}
// Common configurations
console.log(nanoIDEntropy(21, 64)); // Default: 126 bits
console.log(nanoIDEntropy(10, 64)); // Short: 60 bits
console.log(nanoIDEntropy(8, 36)); // Lowercase+digits: 41.4 bitsNanoID Length vs Entropy (64-char alphabet)
| Length | Possible IDs | Entropy (bits) | Brute-Force Time (1B/s) |
|---|---|---|---|
| 10 | 1.15 × 10^18 | 60 | 18 minutes |
| 15 | 1.24 × 10^27 | 90 | 39.6 years |
| 21 | 1.52 × 10^37 | 126 | 4.8 × 10^14 years |
| 25 | 1.15 × 10^45 | 150 | 3.7 × 10^22 years |
| 32 | 6.09 × 10^57 | 192 | 1.9 × 10^35 years |
NanoID vs UUID Comparison
| Property | NanoID (21 chars) | UUID v4 (36 chars) |
|---|---|---|
| Characters | 21 | 36 |
| Entropy | 126 bits | 122 bits |
| Alphabet | Customizable (A-Z, a-z, 0-9, - _) | Fixed (0-9, a-f, -) |
| URL-safe | Yes (by default) | Yes |
| Sortable | No (random order) | No (random order) |
| Readability | Higher (fewer characters) | Lower (longer, hyphens) |
| Storage | 21 bytes (string) | 36 bytes (string) or 16 bytes (binary) |
Benefits
- 60% shorter than UUIDs (21 vs 36 characters) while matching entropy — ideal for URLs, file names, and short codes.
- Customizable alphabet lets you match ID format to your system's constraints (URL-safe, numeric, alphanumeric).
- Cryptographically secure using crypto.getRandomValues() with rejection sampling to eliminate modulo bias.
- URL-safe by default — no percent-encoding needed when used in query parameters or path segments.
Use Cases
URL shortener identifiers where compact, readable, and non-sequential codes prevent enumeration attacks.
Database primary keys in distributed systems that need globally unique, URL-compatible identifiers.
Session tokens and API request IDs that must be short enough for HTTP headers without bloating payload size.
File naming in content delivery systems where predictable sequential names would expose record counts.
Common Mistakes to Avoid
Using NanoIDs shorter than 15 characters for security-critical identifiers — 10-character IDs provide only 60 bits of entropy.
Using non-cryptographic random sources like Math.random() for NanoID generation — predictable IDs enable enumeration attacks.
Storing NanoIDs as indexed columns without considering that random IDs cause B-tree fragmentation, slowing sequential reads.
Using NanoIDs as authentication tokens or secrets — they are identifiers, not credentials, and should not be treated as secret.
Security Implications
A 21-character NanoID with a 64-character alphabet provides 126 bits of entropy, making brute-force enumeration computationally infeasible. However, NanoID's security depends entirely on the randomness source — using Math.random() instead of crypto.getRandomValues() reduces the effective entropy to at most 32 bits (the seed space of typical PRNGs), making IDs predictable after observing a few samples. Short NanoIDs (under 15 characters) are suitable for public identifiers but should never be used as secrets, API keys, or authentication tokens.
Security Information
Frequently Asked Questions
References & Further Reading
What is a NanoID?
NanoID is a compact, URL-friendly unique identifier generator. It produces short, random strings using a customizable alphabet of characters. Unlike UUIDs, which are 36 characters long, NanoIDs can be configured to any length while maintaining the same collision resistance. The default alphabet includes letters, digits, and hyphens/underscores, making the IDs safe for use in URLs without encoding.
NanoIDs are widely used in modern web frameworks (React, Next.js, Vue) for component keys, database IDs, session tokens, and other applications requiring unique identifiers. Their compact size and URL safety make them ideal for API endpoints and database primary keys.
How NanoID Generates Unique Identifiers
NanoID uses a cryptographically secure random number generator (the Web Crypto API) to select characters from a customizable alphabet. The default alphabet contains 64 characters: lowercase letters (a-z), uppercase letters (A-Z), digits (0-9), a hyphen (-), and an underscore (_). This gives each character position approximately 6 bits of entropy.
For a 21-character NanoID with the default alphabet, the total entropy is approximately 126 bits (21 x 6), which provides a collision probability comparable to UUID v4. The compact size means NanoIDs are 36% smaller than UUIDs while maintaining equivalent uniqueness guarantees.
Our implementation uses crypto.getRandomValues for secure random generation and supports custom alphabets and lengths. This allows you to generate IDs tailored to your specific requirements, whether you need ultra-compact IDs or maximum entropy.
Real-World NanoID Applications
Database Primary Keys: NanoIDs serve as unique primary keys in databases, providing compact, URL-safe identifiers that can be used directly in API endpoints without encoding.
Component Keys: In React, Vue, and other component-based frameworks, NanoIDs provide unique keys for list rendering and component identification.
Session Tokens: Short NanoIDs can be used as session identifiers or temporary access tokens, though for security-critical applications, dedicated token generators are recommended.
API Endpoints: NanoIDs in URLs (like /api/users/abc123xyz) are clean, readable, and do not require URL encoding, making them ideal for RESTful API design.
Common NanoID Mistakes
Using Too Short IDs: A 10-character NanoID provides only about 60 bits of entropy, which may be insufficient for high-security applications. Use at least 21 characters for general purposes and longer for security-sensitive identifiers.
Not Using Cryptographic Randomness: Generating NanoIDs with Math.random() instead of crypto.getRandomValues produces predictable IDs. Always use cryptographic randomness for identifiers that need to be unpredictable.
Using NanoIDs for Passwords: While NanoIDs are random, they are designed as identifiers, not passwords. They lack the complexity and length options needed for password security. Use dedicated password generators for authentication.
Custom Alphabet Issues: Removing characters from the alphabet reduces entropy per position. If you customize the alphabet, ensure you maintain sufficient character diversity to meet your collision resistance requirements.
Related Identifier Tools
Explore these unique identifier generation tools:
- UUID Generator — Generate standard UUID v4 identifiers for broader compatibility.
- ULID Generator — Create time-sortable unique identifiers with timestamps.
- UUID Tools — Multi-format identifier generation including UUID, ULID, and NanoID.
- Secret Token Generator — Generate secure tokens for authentication and API keys.
- Random Bytes Generator — Generate cryptographically secure random bytes in various formats.