Nano ID Generator — URL-Safe Unique IDs

Introduction

UUIDs are universal but verbose — thirty-six characters with hyphens clutter URLs and mobile QR codes. Auto-increment integers leak business metrics and collide across distributed shards. Nano ID, popularized by the npm package of the same name, trades RFC formalism for compact URL-safe strings drawn from a 64-character alphabet. You need configurable length, cryptographically secure randomness, and characters that survive query strings without encoding.

Certoflow's Nano ID Generator produces IDs using 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_- — sixty-four symbols safe in URLs and filenames. Length defaults to twenty-one (matching common Nano ID defaults) and clamps between eight and sixty-four. Generation uses crypto.getRandomValues() per character. Compare with UUID Generator for standards-compliant identifiers, ULID Generator for time-sortable IDs, and Nano ID Generator alongside Base64URL Encoder when embedding IDs in JWT subjects.

What this tool does

Setting	Behavior
Length	8–64 characters (default 21)
Alphabet	URL-safe 64-character set
Generate	New ID per click
Copy	One-click clipboard

Output contains no hyphens unless _ or - appear randomly from the alphabet. This is not a UUID v4 replacement for systems requiring RFC 4122 compliance.

How it works

const NANOID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_-";

export function generateNanoid(size = 21): string {
  const len = Math.min(64, Math.max(8, size));
  let id = "";
  for (let i = 0; i < len; i++) {
    id += NANOID_ALPHABET[cryptoRandomIndex(NANOID_ALPHABET.length)];
  }
  return id;
}

Each position is an independent uniform draw. Collision probability decreases exponentially with length — birthday paradox math applies; twenty-one characters from sixty-four symbols provides ample space for most web applications.

Real-world examples

PostgreSQL text primary keys

Replacing serial integers with opaque IDs in public APIs. Generate twenty-one-character keys for seed scripts, paste into SQL inserts, index on varchar(21).

Short link slugs

Internal admin tools map Nano IDs to resources without sequential guessing. Pair with Query String Builder for ?id= URLs.

Client-side temporary keys

React lists need stable keys before server persistence. Generate local IDs for optimistic UI rows — not a substitute for server-authoritative IDs in collaborative apps.

Load test data

Bulk-generate unique strings for CSV import via JSON to CSV pipelines. Verify uniqueness constraints in database migrations.

Contrasting entropy with UUID

Workshop exercise: compare 21-char Nano ID versus 36-char UUID string length in logs formatted with Line Number Generator.

Common mistakes

Using eight-character IDs in high-volume systems. Minimum length is pedagogical; production often keeps twenty-one or increases for collision margin.

Assuming case-insensitivity. Alphabet includes upper and lower case — databases with case-insensitive collations may collide unexpectedly.

Expecting time ordering. Unlike ULID Generator, Nano IDs are not lexicographically sortable by creation time.

Replacing secrets with Nano IDs. IDs are unique, not secret. Use API Key Generator for HMAC keys.

Modulo bias concerns at tiny alphabets. Certoflow uses standard cryptoRandomIndex — for extreme security audits, evaluate rejection sampling in your runtime's Nano ID library.

Embedding without URL encoding when concatenated. Alphabet is URL-safe, but adjacent query parameters still need Query String Builder discipline.

Use cases

Full-stack developers choosing compact primary keys.

Mobile developers shortening deep-link parameters.

Data engineers generating surrogate keys in ETL prototypes.

Educators teaching trade-offs between UUID, ULID, and Nano ID.

QA testers populating unique constraints in test databases.

Technical writers realistic sample IDs in API docs.

FAQ

Is this compatible with npm nanoid?

Same alphabet and default length philosophy; verify collision math for your scale.

Default length?

21 characters.

Cryptographically secure?

Yes — crypto.getRandomValues() per character.

Can IDs include - and _?

Yes. They are part of the alphabet.

UUID versus Nano ID?

UUID is standardized and longer; Nano ID is shorter and URL-customized. Use UUID Generator when spec mandates UUID.

Are IDs stored?

No. Ephemeral browser output only.

Offline generation?

Yes, after page load.

Maximum length?

64 characters in the UI.

Sortable IDs?

Use ULID Generator for lexicographic time ordering.

Database column width?

Size varchar to your chosen max length with index considerations.

Collision math and length selection

When choosing Nano ID length, consider approximate combinatorial space: each position draws from sixty-four symbols, so total possibilities grow as 64^n for length n. At n=21, the space is vast for single-application workloads — collision risk matters only at extreme scale or when adversaries actively hunt IDs. Shorter lengths trade compactness for birthday-bound collision probability. Eight characters from sixty-four symbols yields 64^8 possibilities — fine for ephemeral UI keys, risky as permanent primary keys in tables exceeding millions of rows without uniqueness constraints.

Index design matters alongside length. Fixed-width char(21) versus variable varchar(21) affects storage and index size marginally at web scale but accumulates in analytics warehouses. Case-sensitive collations treat a and A as distinct — the Nano ID alphabet includes both, doubling effective symbol diversity per position compared to lowercase-only schemes. When exporting IDs to Query String Builder URLs, the URL-safe alphabet avoids extra percent-encoding overhead that standard Base64 would require via Base64 Encode.