UUID URL-Safe Encoding — Base64, Short IDs, and URL Slugs

The standard UUID string 550e8400-e29b-41d4-a716-446655440000 is 36 characters — bulky in URLs, log lines, and user-visible IDs. The underlying 128-bit value can be encoded much more compactly without losing any information.

Encoding Options Compared

Base64url (RFC 4648 §5) is the most standard choice: uses A-Z, a-z, 0-9, -, _ — no characters that need percent-encoding in URLs. A UUID’s 16 bytes encode to exactly 22 characters without padding.

Base58 (used by Bitcoin and IPFS) omits ambiguous characters 0, O, I, l — easier to transcribe but no formal standard.

Base64url Encoding in JavaScript

import { parse, stringify } from 'uuid';

function uuidToBase64url(id) {
  const bytes = parse(id); // Uint8Array of 16 bytes
  const bin = String.fromCharCode(...bytes);
  return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
}

function base64urlToUuid(b64) {
  const bin = atob(b64.replace(/-/g, '+').replace(/_/g, '/'));
  const bytes = Uint8Array.from(bin, c => c.charCodeAt(0));
  return stringify(bytes);
}

const id = 'c232ab00-9414-11ec-b3c8-9e6bdeced846';
const short = uuidToBase64url(id);     // "wjKrAJQUEey7yJ5r3s7YRg"
const back  = base64urlToUuid(short);  // "c232ab00-9414-11ec-b3c8-9e6bdeced846"

Base64url in Python

import uuid, base64

def uuid_to_b64url(u: uuid.UUID) -> str:
    return base64.urlsafe_b64encode(u.bytes).rstrip(b'=').decode()

def b64url_to_uuid(s: str) -> uuid.UUID:
    padding = '=' * (-len(s) % 4)
    return uuid.UUID(bytes=base64.urlsafe_b64decode(s + padding))

u = uuid.uuid7()
short = uuid_to_b64url(u)   # 22-char string
back  = b64url_to_uuid(short)  # original UUID

Using Shortened UUIDs in Express / Fastify Routes

// Route with 22-char Base64url ID
app.get('/posts/:id', (req, res) => {
  const uuid = base64urlToUuid(req.params.id);
  const post = db.posts.findById(uuid);
  res.json(post);
});

The database stores the full UUID; the URL shows the compact form. Links look like /posts/wjKrAJQUEey7yJ5r3s7YRg instead of /posts/c232ab00-9414-11ec-b3c8-9e6bdeced846.

NanoID — When You Don’t Need UUID Round-Trips

If you only need a short, URL-safe random ID and don’t need to convert back to a UUID, NanoID generates 21-char strings using a custom alphabet. NanoID values are not UUIDs — they can’t be stored in a uuid column — but they are shorter and simpler when cross-database portability is not required.

Related Resources

• RFC 4648 §5 — Base64url encoding specification
• uuid npm package — parse() and stringify() for byte-level operations
• NanoID — compact URL-safe IDs (not UUID-compatible)
• RFC 9562 §9 — UUID security considerations