Генератор ID Нано

Yes. Sequential IDs leak two pieces of information: how many records exist and how fast they are being created. They also let attackers enumerate your data by incrementing a number in the URL. A Nano ID with the default 21-character length has roughly 126 bits of entropy, so guessing a valid ID is computationally infeasible. Use them whenever an ID is exposed in a URL, share link, or public API.

They have nearly identical collision resistance — UUID v4 has 122 bits of entropy and Nano ID at length 21 has 126. The practical differences are size and character set. UUID v4 is 36 characters with hyphens (which often need percent-encoding); Nano ID is 21 characters from a URL-safe alphabet by default. Nano ID also exposes its alphabet and length so you can shrink IDs for low-volume systems or harden them for high-volume ones.

Random bytes range from 0 to 255, but most useful alphabets are not powers of two — the URL-safe alphabet has 64 characters and the no-look-alikes alphabet has 49. If you simply took a byte modulo the alphabet size, characters at the start of the alphabet would appear slightly more often, which is a subtle bias attackers can exploit. The mask-based algorithm rounds the alphabet up to the next power of two, then discards bytes that fall outside the alphabet — guaranteeing every character is equally likely.

The birthday paradox shows that collisions in a random space appear far sooner than intuition suggests. With N possible IDs, you expect a 50% chance of collision after roughly the square root of N IDs are generated — not N. So an alphabet of 64 characters with 8-character IDs has 281 trillion combinations, but a 50% collision is reached after only about 19 million IDs. This is why IDs intended for large datasets need a length of at least 20–24 characters.

It removes the characters humans most often confuse: zero and capital O, one and capital I and lowercase L, and a few others that are typographically similar. Use it for any code a human might read aloud, transcribe from a screenshot, or type from a printed receipt — coupon codes, support ticket references, two-factor backup codes, or recovery codes. The trade-off is a smaller alphabet (49 vs 64), so increase the length by 1–2 characters to keep the same collision resistance.