Nano ID (nanoid) Generator and Collision Calculator

Nano ID, published as the nanoid package, is an open-source ID generator, first written for JavaScript and since ported to most languages. It produces short random strings like V1StGXR8_Z5jdHi6B-myT: by default 21 characters from a 64-symbol URL-safe alphabet (A–Z a–z 0–9 _ -).

Three properties made it popular:

• Secure randomness. It reads from the operating system's cryptographic generator (crypto.getRandomValues in browsers), never Math.random().
• Unbiased. Every symbol is exactly equally likely, even with alphabets whose size does not divide 256.
• Compact. 21 characters carry 126 random bits, slightly more than the 122 in a UUID v4, in 15 fewer characters and with no hyphens.

This page implements the same algorithm in your browser, so the IDs are interchangeable with ones from the library. A nanoid is just a string: nothing else needs to know how it was made.

The obvious way to pick a symbol is alphabet[byte % alphabet.length]. With 62 symbols that is subtly wrong: 256 = 4 × 62 + 8, so the byte values 248–255 wrap around onto the first 8 symbols, making them 25% more likely than the rest (5 chances in 256 instead of 4). Biased IDs are easier to guess and collide sooner.

Nanoid masks each random byte to the smallest power of two that covers the alphabet (63 for 62 symbols) and throws away values that land outside it. It requests about 1.6 times as many bytes as it needs so one round is almost always enough:

function randomId(alphabet, size) {
  const mask = (2 << (31 - Math.clz32((alphabet.length - 1) | 1))) - 1;
  const step = Math.ceil((1.6 * mask * size) / alphabet.length);
  let id = "";
  while (true) {
    const bytes = crypto.getRandomValues(new Uint8Array(step));
    for (const byte of bytes) {
      const symbol = alphabet[byte & mask]; // undefined when out of range
      if (symbol && (id += symbol).length === size) return id;
    }
  }
}

A collision means generating the same ID twice. With N possible IDs, the birthday bound says you can create about √(2 · N · ln(1 / (1 − p))) IDs before the chance of any duplicate reaches p. For 21 URL-safe characters, N = 64^21 = 2^126, so a 1% risk takes about 1.3 quintillion IDs.

How size changes that with the URL-safe alphabet, from this page's calculator:

Every character you remove divides the safe number of IDs by 8 (the square root of 64). Short codes are fine for small, short-lived sets, but anything stored permanently should stay near the default, and the database column should still have a unique constraint.

A smaller alphabet carries fewer bits per character, so you need more characters for the same safety:

• URL-safe is the best default for URLs, file names and database keys.
• Alphanumeric avoids _ and -, so the whole ID selects with a double-click.
• Lowercase suits case-insensitive systems such as DNS names.
• No look-alikes suits codes that people read from paper or say over the phone.

Both are random, secure identifiers; they differ in format and ecosystem:

Use nanoid for IDs people see: short links, slugs, invite codes, client-side keys. Use a UUID when a database or API expects one, and a ULID or UUID v7 when you need time ordering.

// JavaScript — npm install nanoid (v5 is ESM-only; v3 also supports CommonJS)
import { nanoid, customAlphabet } from "nanoid";
nanoid();                                  // 21 URL-safe characters
customAlphabet("0123456789abcdef", 16)();  // 16 hex characters

# Python — pip install nanoid
from nanoid import generate
generate()                                 # 21 URL-safe characters
generate("0123456789abcdef", 16)

// Go — github.com/matoous/go-nanoid/v2
id, err := gonanoid.New()
hex, err := gonanoid.Generate("0123456789abcdef", 16)

// C# — dotnet add package Nanoid
using NanoidDotNet;
var id = Nanoid.Generate();
var hex = Nanoid.Generate("0123456789abcdef", 16);