Nanoid Generator: Secure Random IDs with Custom Alphabets
This page builds random IDs in your browser the way the nanoid library does, drawing each character from a URL-safe alphabet so the value drops straight into a link, a filename, or a database key. The default size is 21 characters, matching nanoid's own default, and the panel below reports entropy, combinations, and collision odds as you change settings. Switch the mode to ULID for 26 Crockford base32 characters whose first ten encode a millisecond timestamp, so IDs come out in creation order.
Generate and Inspect IDs
Type your own alphabet here, used only when the select is set to custom. No repeats or spaces.
Entropy panel
ID inspector
Paste any 26-character ULID, then press Decode.
How It Works
Each character comes from one random byte, and 256 does not divide evenly into every alphabet size. A plain byte modulo length would favour the first characters, shrinking the real key space. nanoid discards any byte at or above the largest clean multiple of the alphabet length and draws again, so every character stays equally likely.
Entropy here is arithmetic. Bits per ID equal size times log2 of the alphabet length, so 21 characters over 64 symbols give 126 bits while 8 characters over the six symbols in abc123 give about 20.7. Total combinations raise the alphabet length to the power of size, and the collision row applies the birthday approximation to your count.
A ULID splits 26 characters in two. The first ten encode Unix milliseconds in Crockford base32, a set without I, L, O, or U, so values can be read aloud. The remaining sixteen carry 80 bits of randomness, and two IDs made in the same millisecond get an incremented random part.
Before and After
alphabet abc123, 6 symbols
size 8
sample b2a1c331
bits 20.7 per ID
total 1,679,616 combinations
collision 0.0027% across 10 IDsinput 01ARZ3NDEKTSV4RRFFQ69G5FAV
verdict valid, 26 characters
time part 01ARZ3NDEK
timestamp 2016-07-30T23:54:10.259Z
random TSV4RRFFQ69G5FAVUse Cases
| Scenario | Constraint | Pick |
|---|---|---|
| File upload names | Must survive URLs, folders, and repeated uploads | nanoid, size 16, base62 |
| Database primary keys | Unique across billions of rows | nanoid size 21, or ULID |
| Shareable ticket codes | Read aloud over a phone | Crockford base32, size 8 |
Common Mistakes
- Math.random for anything an attacker could guess. It carries no cryptographic seed, so tokens and reset codes built on it can be predicted.
- IDs of four or six characters. The space collapses fast as a service grows, and the collision row shows the odds before you commit.
- A custom alphabet with a repeated character. validateAlphabet rejects duplicates because a doubled symbol is drawn twice as often.
- Judging strength by size alone. Eight digits carry under 27 bits, while the same eight characters over a 64-symbol alphabet carry 48.
- Sorting nanoid values to get creation order. Random IDs say nothing about time, so use ULID or store a timestamp beside the key.
Best Practices
- Pick size from the collision math rather than habit. Enter the count you expect, read the probability, and add a character until the figure sits where you want it.
- Record the alphabet beside every ID when custom sets are allowed. A value drawn from abc123 cannot be checked later if the reader assumes the default.
- Keep 21 for new key columns. It matches nanoid, fits URL and column limits, and leaves room for growth.
- Choose ULID when rows are written over time and read in order. Creation order comes free, and the timestamp helps while debugging.
- Generate security-sensitive IDs on the server with the same size and alphabet rules the client uses, so both sides agree on format.
Frequently Asked Questions
What does the size input change?
Size sets the character count per ID and this field accepts 1 through 64. Total combinations are the alphabet length raised to that power, so each extra character multiplies the space. The default of 21 matches the nanoid library.
Which preset alphabet fits my use?
The default is the stock nanoid alphabet, good for URLs and file names. base62 keeps letters and digits only, a shape that survives spreadsheets and email. Use digits for PIN-style codes, and give it a larger size.
What does the custom alphabet box do?
Set the select to custom and every character comes from the box. Repeats, spaces, and control characters are rejected with the reason shown in the entropy panel. Presets ignore the box.
How does the generator avoid modulo bias?
A plain byte modulo length would favour the first symbols whenever 256 is not a clean multiple of the alphabet. Bytes past the largest clean multiple are discarded and drawn again instead. That rejection sampling is what nanoid uses.
What makes a ULID sortable?
The first ten characters hold Unix milliseconds in Crockford base32 at a fixed width, so string order follows creation time. The other sixteen carry 80 bits of randomness. Two IDs in the same millisecond get an incremented random part.
Can this page read a ULID I already have?
Paste it into the inspector and press Decode. The verdict row confirms every character belongs to Crockford base32, then the timestamp row prints the millisecond and its ISO form. Wrong lengths and the letters I, L, O, and U return a message.
Do the IDs or my settings leave the browser?
No. Generation and decoding run in the page, and no request carries your alphabet, size, or results. Copying to the clipboard is the only step that leaves the tab.