🔑 NanoID Generator
Generate NanoIDs, short, URL-safe, cryptographically-random IDs, at any length, single or in bulk.
NanoID: URL-safe, cryptographically random, rejection-sampled for an unbiased distribution. 🔒 Generated entirely in your browser.
How the nanoid generator works
A NanoID is built from a 64-character URL-safe alphabet (A, Z, a, z, 0-9, plus "_" and "-") using crypto.getRandomValues, with rejection sampling so every character is equally likely (no modulo bias). Each character carries log₂(64) = 6 bits of entropy, so the default 21 characters give 126 bits, slightly more than a UUID's 122 random bits, which is why a NanoID matches a UUID's collision resistance in fewer, URL-friendly characters and with no hyphens to escape. Set the length to suit your needs, or switch tabs for UUID v4/v7 or ULID.
NanoID is popular for short links, tokens and public IDs where a compact URL-safe string beats a long UUID. It uses the same secure randomness, no predictable sequences.
Frequently asked questions
What is a NanoID?
A compact, URL-safe unique-ID format: cryptographically-random characters from a 64-symbol alphabet (A, Z, a, z, 0-9, _ and -). The default length is 21 characters.
How is it different from a UUID?
NanoIDs are shorter and URL-safe (no hyphens to format), and their length and alphabet are configurable. A 21-character NanoID has collision resistance comparable to a UUID.
Is the randomness unbiased?
Yes. This generator uses rejection sampling over crypto.getRandomValues, so every character is equally likely (a naive modulo would slightly favour some characters).
What length should I choose?
The default 21 is a good general choice. Shorter IDs (e.g. 8-12) suit user-facing short links where a small collision chance is acceptable; longer IDs reduce collision risk further.
Why is a NanoID called "URL-safe"?
Its alphabet contains only characters that need no encoding in a web address or filename: letters, digits, underscore and hyphen. That means a NanoID can drop straight into a URL path, query string or filename without being percent-encoded, unlike IDs containing "+", "/" or other reserved symbols.
How many IDs before a collision is likely?
It depends on the length. By the birthday-bound rule of thumb, a collision becomes probable only after roughly the square root of the number of possible values are generated, for the default 21-character NanoID that is astronomically large (around 2⁶³ IDs), so collisions are not a practical concern at any normal scale.
Can I shorten the alphabet or make it case-insensitive?
This tool uses the standard 64-character URL-safe alphabet. If you need case-insensitivity or a smaller symbol set, remember that shrinking the alphabet lowers the bits per character, so you must add characters to keep the same collision resistance, a trade-off worth doing deliberately.
Should I use a NanoID or a UUID for a database key?
Both work as random keys. A NanoID is shorter and URL-safe, which is nicer for public-facing IDs and links; a UUID is the format many databases, ORMs and columns expect natively. Note that neither the default NanoID nor UUID v4 is time-sortable, if you want index-friendly ordering for primary keys, use ULID or UUID v7 instead.
Is a NanoID guessable or is it a secret token?
A NanoID is unpredictable because it uses cryptographic randomness, so at the default length it is not feasible to guess a valid one. But it is an identifier, not an authorization: anyone who sees it can reuse it. Do not treat a NanoID in a URL as a password, protect resources with real access control, and use the password or passphrase generator for secrets.
Is it generated locally?
Yes, entirely in your browser with the Web Crypto API; nothing is uploaded.