
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Generates compact, URL-safe IDs optimized for humans and database performance. Supports random, deterministic, and sequential modes for idempotency, deduplication, and index efficiency.
idkitx is a flexible, URL-safe ID generator designed for performance, compactness, and clarity.
It gives you short, secure IDs that can be random, deterministic, or sequential in either Base62 or Crockford's Base32 character sets. Inspired by the best parts of nanoid, ulid, ksuid, and hashids, it provides a simple API for generating IDs that are both human-readable and database-friendly.
import { generateId } from 'idkitx';
generateId(); // e.g., 'A9bzK2XcPv' (random)
generateId({ length: 8 }); // e.g., '4MfbTz1q' (shorter random ID)
generateId({ input: 'user:42' }); // deterministic — same input = same ID
generateId({ sequential: true }); // e.g., '0v4mG6CZKuSk31H8', sortable by timestamp
generateId({ sequential: true, length: 20 }); // longer sequential ID (must be ≥ 16)
generateId({ alphabet: 'crockford' }); // e.g., '2Z5G1K9DMQ', Base32 Crockford encoding, fewer similar chars, but less entropy per char
✅ Customizable entropy via length
✅ Compact, URL-friendly, human-readable (Base62 or Crockford's Base32)
✅ Deterministic mode for de-duping/idempotency (hash of input)
✅ Sequential mode (timestamp + randomness) for insert performance
✅ Random mode (short but globally unique)
✅ Fully typed, fast, 100% test coverage
idkitx is for developers who want:
It uses Node’s crypto.randomBytes() under the hood, just like uuid, nanoid, and ulid. While this provides strong randomness for uniqueness and distribution, idkitx is not a cryptography library and should not be used to generate secrets or session tokens.
While idkitx is great for compact, flexible ID generation, it’s not ideal for every situation:
| Feature | idkitx | uuid/v4 | ulid | nanoid |
|---|---|---|---|---|
| URL-safe | ✅ | ✅ (v4 only) | ✅ | ✅ |
| Compact (8–16 chars) | ✅ | ❌ (36 chars) | ❌ (26 chars) | ✅ |
| Fully random option | ✅ | ✅ | ❌ (prefix only) | ✅ |
| Deterministic (hash) mode | ✅ | ❌ | ❌ | ❌ |
| Sequential sortable mode | ✅ (best-effort) | ❌ | ✅ | ❌ |
| Zero dependencies | ✅ | ✅ (native only) | ✅ | ✅ |
| Configurable length | ✅ | ❌ | ❌ | ✅ |
| Binary compatibility | ❌ | ✅ (128-bit) | ❌ | ❌ |
| Audited for crypto tokens | ❌ | ✅ (via WebCrypto) | ❌ | ❌ |
⚠️ ULID is sortable within a process, but only guaranteed monotonic with a factory. UUIDv4 is cryptographically secure, but 36 characters long and not sortable.
npm i idkitx
generateId(options?: GenerateIdOptions): stringGenerates a Base62-encoded or Crockford Base32-encoded ID string.
Options:
| Option | Type | Default | Description |
|---|---|---|---|
length | number | 10 or 16 | Total length of the ID. Defaults to 10 (random/deterministic) or 16 (sequential). |
input | string? | undefined | If provided, generates a deterministic ID based on hash of the input. |
sequential | boolean? | false | If true, prepends an 8-char timestamp prefix for sortable IDs. |
alphabet | "base62" or "crockford" | "base62" | Custom alphabet for encoding. Defaults to Base62 (0-9, A-Z, a-z). |
Each character in a Base62-encoded ID contributes approximately 5.95 bits of entropy. Use this to estimate how long your IDs should be based on how many you’ll generate.
| Length | Bits of Entropy | Example Use Case | 1% Collision Likely At |
|---|---|---|---|
| 6 | ~36 bits | Tiny systems, temp tokens | ~600,000 IDs |
| 8 | ~48 bits | Short-lived sessions, test data | ~3 million IDs |
| 10 | ~60 bits | Default for random IDs | ~37 million IDs |
| 12 | ~71 bits | Public slugs, deterministic keys | ~230 million IDs |
| 16 | ~95 bits | Global scale, ULID/UUID alt | ~1.3 billion IDs |
| 20 | ~119 bits | Practically collision-proof | ~75 billion IDs |
If you're using crockford encoding, the entropy per character is slightly lower (5 bits), so adjust your length accordingly.
idkitxuses Node’scrypto.randomBytes()for high-entropy randomness. But even good randomness can collide — make sure your length matches your scale.
main — all tests must pass.Made with 💜 by @mhweiner
FAQs
Generates compact, URL-safe IDs optimized for humans and database performance. Supports random, deterministic, and sequential modes for idempotency, deduplication, and index efficiency.
The npm package idkitx receives a total of 23 weekly downloads. As such, idkitx popularity was classified as not popular.
We found that idkitx demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.