Hashes, IDs, and randomness
How long should a random ID be?
Tools to use
Short random IDs are convenient, but duplicates are a concern. Counting possible strings is a start; you also need the number generated and whether choices are uniform and independent. Change these inputs separately in Entropy & Collision Probability. The result evaluates a stated model, not the safety of a real identifier scheme.
Sixteen symbols over eight positions give 2³² choices
alphabet = 16
length = 8
16⁸ = 4,294,967,296
log₂(16⁸) = 32 bitsEnter alphabet size 16 and length 8. Independent uniform choices from 0–9 and a–f give 4294967296 possibilities and 32 bits of model entropy, not eight bits. Eight decimal digits give a different space. Fixed separators add visible characters but no random choices.
Count symbols the storage and comparison rules actually distinguish. Case-insensitive storage does not preserve A and a as separate choices. Check the generator's alphabet and later normalization before entering a size; the tool does not infer it from a set of real strings.
More generated IDs mean many more pairs
k = 10,000
k × (k − 1) ÷ 2 = 49,995,000 pairsWith sixteen symbols, eight characters and 10000 generated IDs, the chance of at least one collision is about 1.16%. That may seem high for a space of roughly 4.3 billion, but the question concerns any pair, not one chosen reference. Ten thousand IDs contain nearly fifty million pairs.
collisionProbability is a fraction: 0.01 means 1%, not 0.01%. It does not mean one percent of individual IDs are duplicates. It describes the chance that the whole generated set contains at least one duplicate.
Hold the count fixed when comparing lengths
With sixteen symbols, each extra character multiplies the space by sixteen. Compare lengths 8, 9 and 10 while keeping count 10000 fixed. Changing alphabet and count simultaneously obscures the cause. Once you choose a candidate, test the expected maximum population too.
Count the whole namespace in which duplicates matter, not just one batch. Ten thousand per day stored for years is more than ten thousand candidates. Whether separate namespaces permit reuse depends on the system's rules; adding a date prefix does not silently settle that question.
Check whether generation is actually uniform and independent
The model assumes uniform independent choices. Timestamps, counters, biased randomness or repeated seeded sequences do not automatically satisfy it. Constraints such as required character classes can change the candidate set. Match the model against the actual generator before using the result.
For large populations the tool also checks its approximation domain. An unavailable probability is not zero. A displayed space size does not mean every result was calculated. Inspect method and unavailable fields, and do not overstate an approximation's precision.
Low collision risk is not a secret-token guarantee
Avoiding duplicate public product IDs differs from preventing guesses of a password-reset token. The latter needs separate consideration of unpredictability, generation, attempt controls and expiry. This tool does not assess a real password; it accepts model parameters, not a secret's security claim.
Choose an acceptable risk and a collision-handling procedure such as detection and regeneration. Low probability does not automatically remove the need for uniqueness constraints or concurrency handling. These examples compare lengths; they are not a universal recommended identifier size.