NanoID generator

How NanoID entropy works

Each character is drawn uniformly from your alphabet using crypto.getRandomValues. Approximate bits of entropy are size times log2(alphabet length). The default alphabet has 64 URL-safe characters and size 21, which is about 126 bits.

Collision odds rise when size shrinks or the alphabet loses characters (for example hex-only). At about 32 bits you are in toy-token territory. At 64+ bits accidental collisions become unlikely for typical app volumes. At about 126 bits you match common NanoID practice.

Worked example: size 21 vs an 8-character hex ID

Size 21 with the default alphabet yields IDs shaped like V1StGXR8_Z5jdHi6B-myT (illustrative shape). Size 8 with a 16-character hex alphabet is only about 32 bits: fine for demo labels, not for unguessable secrets.

If you need many IDs, raise Count and download the .txt list. Each line is independent; this page does not dedupe against a database.

Limits

NanoIDs are opaque. They are not time-sortable unless you encode time yourself. Prefer UUID v7 or ULID when sort-by-time matters in filenames or indexes.

This page cannot prove global uniqueness; risk is probabilistic from the entropy math. Do not treat NanoID as a password hasher or as a substitute for server-side session secrets without reviewing threat models.

Worked example: picking a size for short share links

Say you want share codes for a link shortener. With the 64-character default alphabet, each character carries 6 bits, so size 10 gives 60 bits and size 21 gives 126 bits. Switch to the No lookalikes preset so people can read codes aloud: the alphabet shrinks, bits per character drop, and you need a slightly longer size to keep the same entropy. Watch the readout under the presets as you change size; it recomputes as size times log2(alphabet length).

Pitfalls

• Custom alphabets with repeated characters. A character that appears twice is picked twice as often, which skews the distribution. Keep each character once.
• Using IDs as secrets. A random ID in a URL can leak through logs, referrers, and screenshots. Treat it as an identifier, not an access token, unless your threat model says otherwise.
• Case-insensitive storage. Some databases and file systems compare case-insensitively. The default alphabet mixes cases, so abc and ABC could collide there; use a lowercase-only alphabet in that case.

NanoID in JavaScript, Python and Go

Default 21-character IDs, a shorter size, and a custom alphabet in each language.

JavaScript: nanoid

import { nanoid, customAlphabet } from "nanoid"; // npm i nanoid

console.log(nanoid());    // 21 chars, A-Za-z0-9_-
console.log(nanoid(10));  // shorter means more collision risk

// Custom alphabet, for example lowercase hex
const hexId = customAlphabet("0123456789abcdef", 16);
console.log(hexId());

Python: nanoid

from nanoid import generate  # pip install nanoid

print(generate())                          # 21 chars, A-Za-z0-9_-
print(generate(size=10))                   # shorter means more collision risk
print(generate("0123456789abcdef", 16))    # custom alphabet, length 16

Go: github.com/matoous/go-nanoid/v2

package main

import (
	"fmt"

	gonanoid "github.com/matoous/go-nanoid/v2" // go get github.com/matoous/go-nanoid/v2
)

func main() {
	id, err := gonanoid.New() // 21 chars, A-Za-z0-9_-
	if err != nil {
		panic(err)
	}
	fmt.Println(id)

	hex, err := gonanoid.Generate("0123456789abcdef", 16)
	if err != nil {
		panic(err)
	}
	fmt.Println(hex)
}

Each snippet was run on October 14, 2026 with nanoid 6.0.2, nanoid 2.0.0 on PyPI and go-nanoid v2.1.0.

NanoID references and sources

• Nano ID (reference implementation): default alphabet, size 21, and the security notes
• Nano ID collision calculator: estimate collision risk for an alphabet, size and ID rate
• W3C Web Cryptography API: getRandomValues(): the browser random source this page uses
• py-nanoid (Python)
• go-nanoid

FAQ