Nano ID Generator
Compact URL-safe identifiers, the default 21-character Nano ID shape.
$ npx nanoid
What it is
Nano ID is a small convention for random identifiers: 21 characters from a 64-character URL-safe alphabet (A-Za-z0-9_-, in the library's own scrambled order), giving 126 bits of entropy. That is essentially the same strength as a UUID v4's 122 bits in 21 characters instead of 36, with no hyphens and nothing that needs escaping in a URL, a filename or a DOM id.
When it's the right choice
Use it when an identifier will be visible — in a URL, in a share link, in an element id — and you want it short and unguessable. Use a UUID instead when something else expects one: a database uuid column, an API contract, a spec. Nano ID has no standard behind it, which is the honest trade: you get a shorter string and you give up the guarantee that every other system knows what to do with it.
On collisions and on the alphabet
At 21 characters the collision risk is a non-issue — you would need to generate roughly a billion IDs per second for a century to reach a 1% chance. Shortening is where care is required: each character you remove costs 6 bits, so a 10-character Nano ID has 60 bits and collisions become realistic at scale. The odd-looking default alphabet (useandom-26T198340PX75px...) is not random-looking for effect; it is the library's fixed ordering, and reproducing it exactly is what makes these interchangeable with what npx nanoid emits. As everywhere on this site, characters are drawn with rejection sampling, so every one is equally likely — the library does the same thing, and for the same reason.
Nano ID or UUID?
Nano ID when the identifier is visible — a URL, a share link, a DOM id — and you want it short: 21 characters and 126 bits of entropy, versus a UUID v4's 36 characters and 122 bits. UUID when something else expects one: a database uuid column, an API contract, a spec. Nano ID has no standard behind it, which is the honest trade.
Is a shorter Nano ID safe?
It depends how many you generate. Each character you drop costs 6 bits, so a 10-character ID has 60 bits and collisions become realistic at scale. At the default 21 characters the risk is a non-issue — roughly a billion IDs per second for a century to reach a 1% chance of one collision.
Why that strange alphabet?
It is not random-looking for effect — useandom-26T198340PX75px... is the library's fixed 64-character ordering. Reproducing it exactly is what makes these interchangeable with what npx nanoid emits. All 64 characters are URL-safe (A-Za-z0-9_-).
Nothing leaves your browser
- Don't take our word for it — turn off your wifi. Every generator on this site keeps working with the network disconnected. That's the whole proof, and it takes five seconds.
- Every value comes from
crypto.getRandomValues()— the CSPRNG built into your browser, neverMath.random(). - Generated secrets are never transmitted, logged or stored: no server-side generation, no cookies, no localStorage.
- Verify it yourself in the network tab: after loading, the page only talks to our self-hosted, cookie-less analytics — which counts page views and which generator type gets copied, never any value.
- Strict Content-Security-Policy; no third-party script origins.