Random Alphanumeric String
Generates a random string of letters and numbers.
Where to find it
Architect Panel → Data:
- Datastores — the datastore, then Table Designer to add or edit a field
Architect Panel → Data:
- Record Numbering — the right tool for human-facing references
What it is for
Values that must be unguessable:
- A token in a link sent to somebody, letting them reach one record without signing in.
- A collection or verification code.
- An external identifier you do not want to be enumerable.
Unguessable is the point
A sequential reference tells anybody who has one that neighbouring values exist. If the value is the only thing standing between a person and a record, that is a problem — somebody who receives /view/1042 will try 1041.
A random string removes that. There is nothing to guess and nothing to enumerate.
Not a reference number
The common misuse. For a human-facing reference — something quoted on the telephone, written on a form, read out to a customer — use record numbering instead.
Random strings are miserable to communicate. They are long, they contain characters people confuse, and they cannot be checked for plausibility. A customer reading one out will get it wrong, and neither of you will know which character.
Length is security
A short random string is guessable by trying. If the value protects access to anything, make it long — the cost of extra characters is nothing, and the difference between short and long is the difference between a control and the appearance of one.
A token is not a permission
Worth stating plainly. Anybody holding the value can use it. It travels in links, sits in mailboxes, appears in browser history and gets forwarded.
So pair it with the things that bound the damage: an expiry, single use where appropriate, and a scope limited to one record and one action. A token that never expires and grants broad access is a permanent credential distributed by e-mail.
Consider what it exposes
Anybody with the link sees whatever it opens. Make sure that is only what the recipient should see — a token intended to let somebody confirm an appointment should not open a record containing case notes.
Generated once
The value is created with the record and stays. If it leaks, the response is to invalidate and reissue rather than to hope — which means having a way to do that.
Worked example
An appointment system sends confirmation links containing a long random token, scoped to that one appointment and expiring after the appointment date. The appointment also carries a human reference from record numbering, which is what staff and customers quote on the telephone. The two do different jobs and neither substitutes for the other.
Recommendations
- Use record numbering for anything humans communicate.
- Make it long wherever it protects access.
- Always add an expiry and the narrowest scope.
- Have a way to invalidate and reissue.