Is NanoID as safe as a UUID?

At the default 21 characters it carries 126 bits of entropy versus a UUID v4's 122, from the same class of cryptographic random source. It is at least as collision-resistant and shorter.

Can I shorten the ID?

Yes, but compute the collision probability for your expected volume first. Each character removed costs 6 bits, and short IDs in a large namespace collide sooner than intuition suggests.

Should I use NanoID for database primary keys?

Prefer UUID v7 or ULID. Both are time-ordered, so inserts append to the index instead of scattering across it — a significant difference at scale.

Is a NanoID safe to expose in a URL?

It is unguessable, which is not the same as authorised. Anything reachable by URL still needs a server-side permission check.

Security🔒 Browser (client-side)API available📴 Works offlinebeginner

NanoID Generator

Generates compact, URL-friendly, cryptographically secure unique string IDs with customizable alphabets and length.

Data stays in your browser

Ready to runInstant execution

All tools →

Result

—

What does this tool do?

Generates compact, URL-friendly, cryptographically secure unique string IDs with customizable alphabets and length.

Why would I use it?

You need short, readable unique tokens for invite codes, short link slugs, or user IDs.
You want a lighter, more compact alternative to 36-character UUIDs.
You want complete control over the character alphabet to prevent profanity or ambiguous letters.

Real-life example

Input

Length: 21, Alphabet: default URL-safe

Output

V1StGXR8_Z5jdHi6B-myT

21 characters provide equivalent collision resistance to UUID v4.

Input → Process → Output → Next

Input: Choose ID length and optional custom alphabet.
Process: Samples uniform random bytes using crypto CSPRNG.
Output: Compact unique string token.
Next action: Embed in URLs, short codes, or database IDs.

Common mistakes

Using very short lengths (<8 chars) for high-volume datasets without collision handling.
Using non-URL-safe characters when IDs will appear in query parameters.
Assuming NanoIDs are sortable (use ULID or UUID v7 if chronological sorting is needed).

What the result means

A compact, collision-safe random identifier suitable for URLs and database keys.

Privacy & security

Your input is processed entirely in your browser and never sent to a YAS server.

API

Endpoint

POST https://yas.sh/api/v1/tools/nanoid-generator

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/nanoid-generator" \
  -H "Content-Type: application/json" \
  -d '{"count":1,"size":21}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/nanoid-generator", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "count": 1,
  "size": 21
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/nanoid-generator", json={"count":1,"size":21})
data = r.json()

Field	Type	Required	Description
count	integer	No (default 1)	Count (1–50)
size	integer	No (default 21)	ID length (4–128)
alphabet	string	No	Custom alphabet

Success response

{ "slug": "nanoid-generator", "count": 1, "size": 21, "result": "V1StGXR8_Z5jdHi6B-myT" }

Generate compact URL-friendly unique IDs.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How NanoID Generator works

NanoID generates a random string from a 64-character URL-safe alphabet (A–Z, a–z, 0–9, _, -), drawing bytes from the platform CSPRNG and mapping them uniformly with rejection sampling. Each character contributes 6 bits, so the default 21-character ID carries 126 bits of entropy — comparable to a UUID v4's 122 bits in a string 40% shorter and with no hyphens.

The collision arithmetic follows the birthday bound: at 126 bits you would need roughly 10^18 IDs before a meaningful collision probability. Shortening the ID is a deliberate trade — a 10-character ID has 60 bits, which is fine for a few million values and unwise for a global namespace, and the honest way to choose a length is to compute the bound for your expected volume rather than to pick a number that looks tidy.

When to use it: real-world scenarios

Generating user-facing identifiers

Shorter and cleaner than a UUID in URLs, without hyphens breaking on double-click selection. Common for share links and document IDs.

Creating React keys or DOM element IDs

Client-side identity for list rendering and label/input association, where uniqueness within the page is all that is required.

Producing short public identifiers for records

Keeps the numeric primary key private while giving the API a stable, non-enumerable public handle.

Naming files or storage objects

URL-safe by construction, so no percent-encoding is needed anywhere in the path.

Pro tips

Compute the collision probability for your actual volume before shortening. Twenty-one characters is the default because it is safe by default, not because it is arbitrary.
Do not treat an unguessable ID as an authorisation token. Always check permissions server-side, regardless of how random the identifier is.
For database primary keys prefer UUID v7 or ULID: NanoID is random and unordered, which fragments B-tree indexes on large tables.
Keep the alphabet URL-safe. A custom alphabet with characters that need percent-encoding defeats the purpose.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Not time-ordered, so it has the same index-locality problem as UUID v4 for database keys.
No embedded metadata — no timestamp, no shard, no version.
Shorter configurations trade collision resistance for brevity in a way that is easy to underestimate.
Not a standard: NanoID is a widely used convention, not an RFC, so interoperability rests on convention.

Frequently asked questions

Is NanoID as safe as a UUID?: At the default 21 characters it carries 126 bits of entropy versus a UUID v4's 122, from the same class of cryptographic random source. It is at least as collision-resistant and shorter.
Can I shorten the ID?: Yes, but compute the collision probability for your expected volume first. Each character removed costs 6 bits, and short IDs in a large namespace collide sooner than intuition suggests.
Should I use NanoID for database primary keys?: Prefer UUID v7 or ULID. Both are time-ordered, so inserts append to the index instead of scattering across it — a significant difference at scale.
Is a NanoID safe to expose in a URL?: It is unguessable, which is not the same as authorised. Anything reachable by URL still needs a server-side permission check.