Random codes or human aliases?

Both, deliberately. Random codes for high-volume machine-generated links (they never collide and leak nothing), human aliases for links people will see, say, or type.

How short should a random code be?

7 characters of base62 is the sweet spot — 62^7 ≈ 3.5 trillion combinations, short enough to type. Longer codes only matter if you expect billions of links.

What characters are safe in aliases?

Lowercase letters, digits, and hyphens. No underscores, no spaces, no mixed case — those get mangled by copy-paste and voice assistants.

Short Codes & Aliases: Slug Best Practices That Scale | yas.sh

How to design short-link slugs that are short enough to type, safe to share, and semantic enough to build trust — with the rules that keep them collision-free.

The slug is the only part of a short link you control, and it does two jobs at once: it's a database key and a piece of copy. Most teams design for one and forget the other. Here's the framework that handles both.

Two families, two jobs

Random codes — yas.sh/Ab3xK9q — are generated by the platform: base62 alphabet (0-9a-zA-Z), 7 characters, ~3.5 trillion combinations, collision-resistant by construction. They're for machine-generated links: API exports, bulk uploads, anything where nobody will ever read the URL aloud.

Human aliases — yas.sh/launch24 — are written by people for people. They're semantic, memorable, and readable in a printed flyer or a podcast show note. They're for links that carry brand: campaigns, product launches, bio links.

The rule: if a human will see the link, give it a human slug. If only a machine will, let the platform generate one.

Slug hygiene that scales

Whatever you choose, the same hygiene rules apply:

Lowercase only. Launch24 and launch24 are two different links — and someone will get one wrong. Enforce lowercase at creation.
Hyphens, not underscores. black-friday survives copy-paste and voice assistants; black_friday gets eaten by underline-hiding text styles.
No reserved words. admin, login, api, dashboard, wp-admin, favicon.ico and a few dozen more should be blocked as aliases — they collide with platform routes and confuse crawlers.
Keep it short. 3–5 words max. The entire point is fewer keystrokes than the destination URL.
No dates in the middle of slugs you'll reuse. summer-2026-sale is dead in November; summer-sale survives. If you version, version at the end: summer-sale-2026.

The collision question

Two links cannot share one alias — that's a hard uniqueness constraint. Teams that don't plan for this hit it at the worst time: during a campaign when they need /launch but it's taken by last quarter's page.

The fix is a naming convention before you need it:

Use case	Pattern	Example
Campaign	`campaign-name-<year>`	`summer-sale-2026`
Product	`product-slug`	`pro-plan`
Per-piece content	`topic-slug`	`launch-post`
Permanent pages	`brand-term`	`pricing`

And keep a small registry — the yas.sh dashboard search makes this trivial: check before you create, and you never discover collisions by watching a campaign fail.

Slugs are URLs are contracts

A short link published in a printed brochure, a QR code, or a million-email send is permanent infrastructure. The slug generator helps you produce clean slugs from messy titles — but the decision framework is human: would you be happy seeing this slug on a billboard? If the answer is no, don't create it. If yes, it'll outlast the campaign that created it.