Why are access tokens so long in general?

Question

I was looking at this Nano ID page where they generate a 21 characters long ID and it would take 149 billions years to find a collision, so that seems secure enough.

However I found that most APIs use much longer tokens for authentication. For example, Dropbox uses a 64 characters long token (made of complete alphabet and numbers) and OneDrive uses a 1180 characters long token (also made of complete alphabet and numbers).

So I'm wondering why do they use such long tokens? And related questions, what's an ideal size for a token made of random letters and numbers?

Answer 1

One way of producing a secure token is to sample 256 bits of entropy and encode that into a usable character set (often base64). This will get you the shortest secure token. But by design, this token will be completely opaque - that is, it contains no information so that any use of it will require a lookup into a database.

There are all sorts of engineering trade-offs that you might want to make, balancing a longer token against making them easier to use or validate. For instance, you might want to augment your random token from which you can extract information about: the account id, the customer's region (for geographic sharding), expiration time, etc. These will result in longer tokens, but there is a very low cost associated with slightly longer tokens.