Nano ID is a tiny, secure, URL-friendly unique string ID generator for JavaScript, designed to create short IDs with a URL-safe alphabet. It supports secure and non-secure modes (using hardware random generation by default) and can be customized by ID size or alphabet.
Project status
- The source appears actively maintained, with upstream pushes on 2026-10-05 and multiple version “updates” published the same day, plus additional updates in late summer 2026 (Aug 3 to Aug 7) and mid-summer (Jul 12), indicating ongoing development rather than dormancy.
- The apparent update cadence is fairly frequent, for example, Oct 5 includes 6.0.2 and 3.3.20, and there are other updates roughly every few weeks through mid to late 2026 (Jun 21, Jun 24, Jul 12, Aug 3, Aug 7).
AI summary generated
Recent updates
6.0.2
Release 6.0.2 release notes claim only bundle size reduction and targeted fixes to customRandom, plus doc corrections. However, the actual diff up to 6.0.2 shows much broader changes, including ESM refactors, removal of the nanoid/async entrypoints, and meaningful runtime behavior changes in random/customRandom and TypeScript typings.
3.3.20
Release 3.3.20 is a types-only update, per the release notes. The code diff shows new TypeScript declaration files added for the async entry point and package.json mappings updated so TypeScript resolves types from the async subpath.
3.3.19
This patch updates nanoid to prevent crashes when extremely large ID sizes are requested (the release notes describe it as fixing app termination caused by a huge user ID). The code changes also align the Node ESM/CJS entry behavior around ID size limits and improve error handling to avoid leaving the internal random buffer pool in a bad state.
3.3.18
Release 3.3.18 claims to fix an infinite loop affecting async generation on React Native. The code diff shows a much broader change set, including consistent handling for customAlphabet size values (0 and negative) to prevent hangs, and a major packaging refactor (ESM/CJS entrypoints plus a new package.json exports map).
Breaking6.0.1
Release 6.0.1 release notes claim only a documentation fix. However, the actual diff from 3.3.17 to 6.0.1 shows substantial changes to runtime code, exported entry points, and TypeScript types beyond docs.
Breaking3.3.17
Release 3.3.17 claims a single change: fixing an infinite loop when generating IDs with a zero size. The code diff shows more than that, including module system and packaging changes (CommonJS to ESM via new entrypoints and exports maps) and additional behavior changes around non-positive sizes.
Breaking6.0.0
Release 6.0.0 claims two changes: faster nanoid() and customAlphabet(), and removal of Node.js 18 and 20 support. The code diff shows a much broader refactor of the RNG/generation logic (Node and browser paths), plus several API surface and TypeScript declaration changes that are not mentioned in the release notes.
Breaking3.3.16
Version 3.3.16 includes a fix for an infinite loop when the generator is called with a negative size. The code changes in this release are much broader than that single bug fix, including major module format and packaging changes (ESM/CJS entrypoints and exports map).
5.1.16
Release 5.1.16 notes only mention a fix for an infinite loop when Nano ID is called with a negative size. However, the actual diff from 3.3.15 to 5.1.16 shows this fix alongside broader changes to the node and browser implementations, TypeScript typings, and exported entrypoints. It also removes the entire async API surface.
3.3.15
Release 3.3.15 only documents a fix for an npm provenance error. However, the code diff shows a much larger packaging and module-system refactor, including new .cjs entrypoints, ESM conversions, and a new exports map with conditional entry resolution.
5.1.15
Release 5.1.15 is described as a targeted fix for random pool corruption when generating large Nano ID strings. The provided code diff, however, shows additional refactors to the Node and browser implementations, TypeScript types, and even removal of entire async entrypoints that are not mentioned in the release notes.
3.3.14
Release 3.3.14 claims to fix random pool corruption when generating large Nano ID sizes. The code diff shows a much broader packaging and module-format overhaul (CommonJS to ESM, new conditional exports, new *.cjs browser/entry files) in addition to the pool-corruption fix.
BreakingFeatures5.1.14
Release 5.1.14 is a small packaging maintenance update intended to address an npm package size regression. The release notes only mention the size fix, and the code diff shows the change is confined to release metadata and the packaging/cleanup workflow.
5.1.13
Release 5.1.13 bumps the package version and updates CI tooling used to clean the npm package. The only documented change is a fix for an npm package size regression, and the repository changelog reflects that.
5.1.12
Release 5.1.12 release notes only mention publishing pipeline changes: moving to npm Provenance and staged publishing. The actual code diff shows substantial library changes to the Nano ID generation implementation, module formats for some entrypoints, TypeScript typings, and removal of the async API.
3.3.13
Release 3.3.13 claims only that the npm package size was reduced. However, the code diff shows a broader refactor around module formats (CommonJS vs ESM), plus runtime behavior changes in the ID size validation path.
5.1.11
Release 5.1.11 is documented as a fix for “breaking Nano ID by requesting big ID”. The code changes in this version range include that size handling fix, but also show broader undocumented refactors across the Node and browser implementations, export style, and TypeScript types.
Breaking3.3.12
Release 3.3.12 states it fixes Nano ID breaking when requesting a big ID. The code change set goes far beyond that one-line note, introducing a major ESM/CJS packaging refactor (conditional exports and new entrypoint files) and adding explicit runtime bounds checking for requested ID sizes.
Features5.1.10
Release 5.1.10’s notes say it fixes a breaking issue in nanoid by “requesting big ID”. The actual code diff for this tag shows much broader changes beyond that single fix, including API surface removal (async entrypoints), ESM export changes, TypeScript typing changes, and modifications to the core ID generation algorithm and edge-case handling.
5.1.9
Release 5.1.9 publishes a version bump and claims to fix an npm package size regression. The code diff indicates the change is related to what gets included in the npm package rather than any runtime/API logic.