UUID to Base64, and the short forms

Why 22 characters and not 24#

Base64 encodes three bytes into four characters. Sixteen bytes is five whole groups plus one byte left over, so the encoder emits 22 characters and then pads with == to reach a multiple of four. The padding carries no information for a fixed-length input: everyone knows a UUID is 16 bytes, so the two equals signs can be dropped and re-added by the decoder.

RFC 4648 § 4 · Base 64 EncodingThe standard alphabet and the padding rule

RFC 4648 § 5 · Base 64 Encoding with URL and Filename Safe AlphabetThe URL and filename safe alphabet: - and _ instead of + and /

Which alphabet to use#

Base64 does not preserve sort order#

The Base64 alphabet runs A-Z, a-z, 0-9, which is not the order the underlying bytes compare in. Two v7 identifiers made a second apart sort correctly as bytes and as text, but not as Base64. If a time-ordered key is the point, keep the bytes or the hex form; if all you want is a short opaque handle, Base64 is fine.

import { parse, stringify } from "uuid";

const bytes = parse("f81d4fae-7dec-11d0-a765-00a0c91e6bf6");

const short = btoa(String.fromCharCode(...bytes))
    .replace(/\+/g, "-")
    .replace(/\//g, "_")
    .replace(/=+$/, "");

const back = stringify(Uint8Array.from(
    atob(short.replace(/-/g, "+").replace(/_/g, "/")),
    c => c.charCodeAt(0),
));

Every alphabet, and what it costs#

Base64 is one row in a table people usually meet one row at a time.

Base58 lands at the same 22 characters and drops 0, O, I and l, which makes a value survivable when it is read aloud or copied by hand. The cost is an encoder that needs big-integer arithmetic rather than bit shifting, and thinner support in standard libraries. Crockford base32 is the usual compromise when people have to handle the value: four characters longer than base64url, case-insensitive, and it keeps byte order.

What not to do#

• Truncating. Dropping bits does not shorten an identifier, it creates a different one with a real collision probability.
• A private alphabet nobody documents. Six months later nobody can decode the values in the logs.
• Storing the short form as the key. Store the bytes; render the short form.