When to use a random string
Random strings serve very different purposes depending on context. They're not the same as a password, even though they're generated the same way underneath. Common cases:
- Internal tokens: beta invitation codes, signed download links, password reset tokens.
- Short IDs: a shorter alternative to UUID when readability or length matters (URL slugs, visible IDs).
- Unique filenames: to prevent collisions when uploading to S3, R2 or GCS.
- Test data: filling text fields in seeds and fixtures without making them look realistic.
- Coupon codes: when you want something shorter than a UUID but still secure.
Choosing the alphabet
The alphabet affects readability, entropy per character, and where you can use the string.
- Digits only (10): 3.32 bits/char. For one-time codes (OTP).
- Lowercase alphanumeric (36): 5.17 bits/char. Good for URL slugs.
- Base62 (62): 5.95 bits/char. Standard for short IDs and tokens.
- Hex (16): 4 bits/char. Compatible with almost everything.
- With symbols (~95): 6.57 bits/char. Only when the destination supports them.
How entropy is calculated
The formula is bits = length × log2(N), where N is the alphabet size.
Practical examples:
- 16 alphanumeric characters = 95 bits. Plenty for any internal token.
- 21 base62 characters = 125 bits. The nanoid default.
- 32 hex = 128 bits. Equivalent to a UUID v4.
- 43 base62 = 256 bits. For master encryption keys.
Below 64 bits, assume an attacker can brute-force it. Above 128 bits, it's out of reach even with massive compute.
Token best practices
- If the token goes in a URL, avoid symbols that need escaping.
- If humans will read it, skip ambiguous characters (0, O, 1, l, I).
- Store a hash if the token is used for authentication, not plaintext.
- Give it a real expiration, not infinite.
- Log usage (creation, first use, last use at minimum).
When NOT to use this generator
Don't use it as a primary password for a human account — the password generator is tuned for that. Don't use it for IDs that need to be coordinated across distributed systems — UUID v4 or v7 is the right tool there. And don't use it for data that has to be stable: every generation produces something different, unless you copy and paste.