I was looking at this Nano ID page where they generate a 21 characters long ID and it would take 149 billions years to find a collision, so that seems secure enough.

However I found that most APIs use much longer tokens for authentication. For example, Dropbox uses a 64 characters long token (made of complete alphabet and numbers) and OneDrive uses a 1180 characters long token (also made of complete alphabet and numbers).

So I'm wondering why do they use such long tokens? And related questions, what's an ideal size for a token made of random letters and numbers?

  • 1
    $\begingroup$ The example oauth1 token secret for dropbox only appears to be 15 characters long, and has a minimum length of 1? $\endgroup$
    – Modal Nest
    Commented Dec 16, 2020 at 15:47
  • $\begingroup$ Maybe this question would be better suited for security-SE. $\endgroup$
    – tylo
    Commented Dec 16, 2020 at 17:57

1 Answer 1


One way of producing a secure token is to sample 256 bits of entropy and encode that into a usable character set (often base64). This will get you the shortest secure token. But by design, this token will be completely opaque - that is, it contains no information so that any use of it will require a lookup into a database.

There are all sorts of engineering trade-offs that you might want to make, balancing a longer token against making them easier to use or validate. For instance, you might want to augment your random token from which you can extract information about: the account id, the customer's region (for geographic sharding), expiration time, etc. These will result in longer tokens, but there is a very low cost associated with slightly longer tokens.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.