Creating unguessable Short URLs for links


I was wondering if Branch offers any way of creating unguessable short URLs. Whenever I create a short url using the api I get a 10 character long unique id. However, to avoid crawling the link since sometimes I send sensitive data, I would like to increase the length of this random id. Firebase currently offers this with their ‘UNGUESSABLE’ option, where they create 17 character long unique id’s which are a lot harder to guess/crawl.

Is this something that you offer too? If not, I’d like to suggest that you do add it. Security is a main concern for a lot of companies and preventing links from being easily crawled is a neat feature.

Thanks a lot, keep up the great work!


Apponaut — Other
1 Answer(s)
Answered on November 7, 2016.

Hi there! This is a good question, and there are a few important things to keep in mind:

  1. Security by obscurity is never totally safe. Having an ‘unguessable URL’ is only as good as both your ability to keep that URL itself confidential and your ability to match users with 100% confidence (something Firebase does not support at all). You should never permanently encode truly private information inside any link. Always assume the contents of a link could become public at any time. To be honest, I’m a bit disappointed that the Firebase team has not done a better job of clarifying this in their documentation.
  2. If you decide having obscure URLs as your security solution is acceptable for your situation, you should carefully read our recommendations for handling confidential information, specifically around checking for the +match_guaranteed parameter. You should also consider using an expiring token inside your link instead of the information itself, to limit the damage if a link later becomes compromised.
  3. Firebase’s ‘unguessable’ URLs are formed by base62-encoding randomly generated 96-bit numbers. Standard Branch links are created by base62-encoding randomly generated 64-bit numbers. This results in a shorter link slug (10 characters for Branch, vs. 17 for Firebase), but still means there are 839,299,365,868,340,224 total possibilities. Even with the shorter link, this is effectively ‘unguessable’ (provided you can keep the rest of your system completely watertight).
  4. If you really want a longer link URL,  you can do this yourself by generating a hash and setting it as the link’s alias.

Hope this helps!

Branch — Developer
Commented on November 7, 2016.

Hi Alex. Thanks a lot as always for your very thorough answer!

Im  curious, how many percent of all of your link clicks (in %) are:

-Links where you know the cookie from before
-Links where you have to use some other form of matching (matching with device, ip etc)

Apponaut — Other