Pick a length and an alphabet, and see the years-to-collision alongside
NanoID defaults to 21 characters drawn from a 64-character URL-friendly alphabet. Sixty-four to the twenty-first power is 2 to the 126th, about 8.5 x 10 to the 37th. The random part of a UUID v4 is 122 bits, about 5.3 x 10 to the 36th, so the default NanoID is somewhat larger. The length of 21 was chosen to match or beat UUID strength in 21 characters instead of 36. Shortening it costs strength, so when you change the length it is worth watching how the number of combinations moves. That is why this tool reports the years-to-collision next to the IDs.
Shrinking the alphabet has the same effect. Digits alone give ten characters, dropping the information per character from about 6 bits to about 3.32. Keeping the same strength then takes nearly twice the length. Wanting a shorter ID and wanting a smaller alphabet both spend from the same budget.
When picking characters from random bytes, taking the remainder after dividing by the alphabet size makes the first characters slightly more likely. Divide 256 by 62 and you get 4 with 8 left over, so the first eight characters get five slots each while the other fifty-four get four. This tool follows upstream NanoID: mask the byte down to the smallest bit pattern that covers the alphabet and discard values that fall outside it. That reads a few more random bytes, but every character becomes equally likely.
| Alphabet | Per character | Combinations at 21 characters | Comparable to |
|---|---|---|---|
| 64 characters (default) | 6 bits | about 8.5 x 10^37 (2^126) | a little larger than a UUID v4's random part (about 5.3 x 10^36) |
| 62 characters (alphanumeric) | about 5.95 bits | about 4.4 x 10^37 | where symbols are not allowed; practically the same size |
| 36 characters (lowercase and digits) | about 5.17 bits | about 4.8 x 10^32 | places where case cannot be kept |
| 16 characters (hexadecimal) | 4 bits | about 1.9 x 10^25 (2^84) | a truncated hash |
| 10 characters (digits) | about 3.32 bits | 10^21 | short codes, compensated with length |
Randomness comes from the browser's crypto.getRandomValues. Where secure randomness is unavailable the tool says so and generates nothing, rather than silently switching to a predictable source.
Twenty-one characters drawn from a 64-character alphabet give 64 to the 21st power, which is 2 to the 126th, about 8.5 x 10 to the 37th. The random part of a UUID v4 is 122 bits, about 5.3 x 10 to the 36th, so the default NanoID is somewhat larger. It is the length that matches or beats UUID strength in 21 characters instead of 36.
Use a UUID when the format is fixed for you: a UUID column in the database, or an external specification that requires it. If the value only has to live in your own URLs or file names, a NanoID is shorter and uses just two symbol characters.
It uses the birthday approximation k = sqrt(2 x N x ln(1 / (1 - p))), where N is the alphabet size raised to the length and p is one percent. The result is divided by the hourly generation rate and converted to years. The arithmetic is done in logarithms because the numbers are large.
No. Randomness comes from the browser's crypto.getRandomValues and generation happens entirely on this page. If secure randomness is unavailable the tool says so rather than silently falling back to a predictable source.