Random Slug Generator

Random slugs vs UUIDs vs auto-increment IDs

Three common ways to identify a resource: an auto-increment integer (1, 2, 3...), a UUID (550e8400-e29b-41d4-a716-446655440000), or a short random slug (k7p2x9q3m1). Each has a clear use case. Auto-increment IDs are perfect for internal database keys but a disaster for public URLs because they leak ordering — anyone can guess that /order/41 exists if they can see /order/42, and they can enumerate your entire dataset by counting up. UUIDs solve the guessability problem but produce hideous URLs that nobody can read, dictate or remember. Short random slugs hit the sweet spot: unguessable enough for share links and magic links, short enough to be human-friendly, and easy to generate in bulk for things like room codes, invitation tokens and draft URLs.

How long should a random slug be?

The math is simple: each character of an alphanumeric slug adds roughly six bits of entropy. An eight-character slug has about 47 bits of entropy — enough that the chance of a collision within a million generated slugs is roughly one in 30 million. Ten characters pushes that to 60 bits and effectively eliminates collision risk for any normal application. For security-sensitive tokens (password resets, magic-login links) prefer 16+ characters because the threat model includes brute-force enumeration, not just accidental collision. For human-shareable codes (Zoom-style room codes, invite links you read out loud) keep it to 8-10 characters and bias toward word-based mode for memorability.

Word-based slugs and the human factor

Codes like brave-otter-127 have a charming history. Heroku popularised them as app names because random English words plus a digit produce identifiers that feel friendly, are easy to dictate over the phone, and remain unique across millions of records. The same pattern works for any product that exposes generated identifiers to humans — shared documents, multiplayer game rooms, recording session IDs, internal experiment names. The psychological effect is real: a user who sees swift-falcon-482 in a URL trusts the product more than one who sees x7k29m, even though both are equally random.

The trade-off is a smaller keyspace. A two-word slug from a dictionary of a thousand adjectives and a thousand nouns gives you a million combinations — comfortable for a small app, tight for a global service. Add a numeric suffix to expand the space without sacrificing readability. Always pair word slugs with a uniqueness check at the database layer.