Is shortid still maintained?

No — shortid stopped being maintained around October 2020. shortid's own maintainers named nanoid as the successor.

• successor named by the maintainers
• high confidence
• package successor

What should I use instead of shortid?

shortid's own maintainers named nanoid as the successor. nanoid is not a drop-in replacement, so expect to change call sites.

How to migrate from shortid to nanoid

shortid.generate() becomes nanoid(). The default Nano ID length is 21 characters rather than shortid's 7-14, so widen fixed-size database columns before switching.

Why shortid is on this list

The shortid README states that the package is deprecated because its architecture is unsafe and recommends Nano ID in its place. Development stopped with 2.2.16 in October 2020; a 2.2.17 republish appeared on npm in January 2025, but the repository has had no commits since 2020. Nano ID uses a cryptographically secure random source and is smaller and faster.

The succession is settled: primary sources agree and the ecosystem has already moved.

shortid alternatives

Beyond the primary recommendation, these are credible for shortid's use case:

• uuid — view on npm
• @paralleldrive/cuid2 — view on npm

Check your own project for shortid

npx dead-deps --all --min-state unmaintained

Run that in the directory holding your lockfile. If shortid is anywhere in your tree — a direct dependency or buried under something else — it appears in the report with this verdict, this successor and the same evidence links, alongside anything else that has stopped moving. Nothing is uploaded; the scan reads your lockfile locally and queries public registry metadata.

Exit code 1 means something was flagged, which makes npx dead-deps --min-state deprecated usable as a CI gate. See how verdicts are produced.

Evidence

Every claim on this page traces to a primary source. Check them:

• shortid README deprecation notice recommending Nano IDgithub.com
• nanoid repositorygithub.com

Packages related to shortid

• cuidReimplementation: @paralleldrive/cuid2 · unmaintained since January 2023
• eslint-loaderSuccessor named by the maintainers: eslint-webpack-plugin · unmaintained since April 2020
• momentSuccessor named by the maintainers: luxon · unmaintained since September 2020
• node-uuidRenamed package: uuid · unmaintained since March 2017
• babel-preset-es2015Successor named by the maintainers: @babel/preset-env · unmaintained since April 2017

See the full index of covered packages, or read the methodology for how a verdict is reached and why a quiet package is not a dead one.