NanoID / ULID Generator

NanoID and ULID: when UUID feels too long

NanoID was created by Andrey Sitnik and published on npm in 2017 as a more compact alternative to UUID v4. The default output is 21 characters drawn from a 64-character URL-safe alphabet (A-Z a-z 0-9 _ -), giving you 21 × log₂(64) = 126 bits of entropy. That is essentially the same collision resistance as UUID v4 (122 bits), but in 21 characters instead of 36 — and without the hyphens that force you to percent-encode the value in some contexts.

To put the math into perspective: generating 1 billion NanoIDs per second, you would need roughly 21 years before a single collision becomes likely. For any realistic workload, NanoID is as safe as UUID v4 while being shorter, URL-safe out of the box, and around 2x faster in some Node.js benchmarks because there is no hex-formatting overhead.

Custom alphabets

NanoID lets you swap the alphabet. A common trick is to remove visually ambiguous characters (0/O, 1/l/I) when humans will type the ID. Pick a length that compensates for the smaller alphabet: with 32 characters of Crockford Base32, you need 25 characters to match the entropy of the default 21-char NanoID.

ULID: sortable by construction

ULID — Universally Unique Lexicographically Sortable Identifier — was proposed by Alizain Feerasta in 2016. It encodes 128 bits as 26 characters of Crockford Base32 (no I, L, O or U to avoid confusion). The layout is 48 bits of Unix-millisecond timestamp (good until the year 10889) followed by 80 bits of randomness. The key property: lexicographic order equals creation order — sorting strings sorts the IDs by time.

That makes ULID a strong choice for primary keys in distributed databases: you get the locality benefits of an auto-increment column (newer rows cluster together in B-tree indexes) without coordinating a counter between nodes. Within the same millisecond, the spec recommends a monotonic counter to keep ordering stable.

NanoID vs ULID vs UUID v4 vs KSUID

• NanoID — compact, fully random, URL-safe. No timestamp.
• ULID — sortable, embeds a timestamp, Base32. 128 bits.
• UUID v4 — RFC 9562 standard, ubiquitous, but long (36 chars) and not sortable.
• KSUID — similar to ULID (timestamp-prefixed), 27 chars Base62, 32-bit second-resolution timestamp.

FAQ

Can I use NanoID or ULID in URLs? Yes — both are URL-safe without escaping. NanoID uses _ and -; ULID uses only uppercase alphanumerics.

Is NanoID really faster than UUID? In Node.js benchmarks NanoID is roughly 2x faster than the canonical UUID v4 generator because it skips the hex formatting and hyphen insertion. The gap shrinks with native crypto.randomUUID().

Does clock drift break ULID? A backwards clock jump can produce IDs that sort out of order, but the random component makes a collision astronomically unlikely. Most ULID libraries detect the regression and bump the counter to preserve monotonicity.