Privacy · Link Security

Short Link Slug Length Matters: Why 2, 4, and 6 Characters Are Deliberate Privacy Choices

Published June 2026 · 8 min read · By the TraceNull Team

When you shorten a URL, you probably don't think much about the random string at the end — the slug. Whether it's tracenull.cc/aB3x or tracenull.cc/Qm, it looks like a trivial implementation detail. It isn't. The length of that slug is one of the most consequential design decisions a privacy-first URL shortener can make, affecting brute-force resistance, enumeration attacks, link lifespan, and ultimately how much of your activity can be discovered by a third party.

At TraceNull, we offer three tiers — Free (4-character slugs), Pro (6-character), and Business (2-character) — and each length was chosen for a specific reason. This article breaks down the math, the threat models, and the design philosophy behind tiered slug lengths.

The Anatomy of a Short Link Slug

A slug is the unique identifier appended to a short domain. In tracenull.cc/aB3x, the slug is aB3x. Most shorteners generate slugs from an alphanumeric character set: a-z, A-Z, and 0-9 — 62 possible characters per position.

The number of unique slugs you can generate is 62ⁿ, where n is the slug length:

That range — from under four thousand to over fifty-six billion — is enormous. And it maps directly to how hard it is for an attacker to guess or enumerate your links.

Threat Model: Brute-Force Enumeration

The primary threat against short links is enumeration: an attacker systematically tries every possible slug to discover active links and their destinations. This is not theoretical. Researchers have demonstrated large-scale enumeration against Bit.ly, goo.gl, and other shorteners, uncovering private documents, unlisted files, and sensitive redirects.

How slug length changes the math

Assume an attacker can make 1,000 requests per second (modest, especially with distributed infrastructure):

A 2-character slug can be fully enumerated in seconds. A 6-character slug is effectively immune to brute-force enumeration at any realistic request rate. The 4-character slug sits in between — feasible to attack over hours, but only if the links are still alive.

Why TraceNull Pairs Slug Length with TTL

This is the core of our tiered design. Slug length and time-to-live (TTL) are coupled deliberately:

Free tier: short slug, shorter lifespan

Four characters give you ~14.7 million possible slugs. At 1,000 requests/second, full enumeration takes about 4 hours. But the link expires in 2 hours. By the time an attacker could scan even half the keyspace, your link is already gone — it returns a 404. The slug is recycled. There's nothing to find.

This is privacy through ephemerality. The link exists just long enough to be useful, then vanishes.

Pro tier: long slug, long lifespan

Six characters push the keyspace to 56.8 billion. Even at 10,000 requests/second, exhaustive enumeration takes roughly 180 years. Your link can safely live for 90 days — or 90 months, frankly — without realistic enumeration risk. Pro users get durability and security simultaneously.

Business tier: short slug, layered protection

Two-character slugs are deliberately short for a reason: they're memorable, brandable, and easy to dictate verbally. A slug like /Qm is ideal for business cards, presentations, or internal team use. But the small keyspace means these links need additional protection layers:

• Custom domains — the attacker doesn't know which domain to enumerate against
• Password protection — even if a slug is guessed, the destination is locked behind a passphrase
• API access with rate limiting — programmatic creation with abuse controls
• Analytics without tracking — you see click counts, but no user data is stored

The short slug is a feature, not a compromise — because the security model doesn't rely on slug length alone.

What Other Shorteners Get Wrong

Most mainstream URL shorteners assign slug lengths based on database efficiency or vanity — not security. Here's what we commonly see:

1. Fixed-length slugs with no TTL. Services that give every link a 6- or 7-character slug but let it live forever. The keyspace is large, but the accumulation of active links over years means a larger and larger percentage of random guesses will hit a live target.
2. Sequential or predictable slugs. Some shorteners use auto-incrementing IDs encoded in base62. This means an attacker doesn't need to brute-force randomly — they can simply increment: /a, /b, /c... discovering every link ever created, in order.
3. No referrer stripping. Even if the slug is strong, the destination URL leaks back to the shortener (and any intermediaries) via the Referer header. TraceNull strips this at three independent layers — Node.js response headers, Caddy reverse proxy headers, and an HTML meta referrer-policy tag — so even if a link is discovered, the connection between source and destination is severed.

The Entropy Equation: Slugs as Keys

It helps to think of a slug as a cryptographic key of sorts. It's not encrypting anything, but it is the sole barrier between the public internet and your destination URL. The entropy of that key matters:

For comparison, a 4-digit PIN has ~13.3 bits of entropy. A 4-character slug is roughly equivalent to a 7-digit PIN. A 6-character slug approaches the entropy of a simple password. None of these are replacements for real authentication — which is why Business-tier links add password protection on top.

Practical Recommendations

For quick, disposable sharing

Use Free-tier 4-character slugs. Share a link in a chat, email, or meeting. It works for 2 hours, then it's gone. No one can enumerate it in time, and no trace remains afterward.

For campaign links and affiliate URLs

Use Pro-tier 6-character slugs with 90-day TTL. Pair them with the UTM builder to track campaign performance without leaking user data through referrer headers. The keyspace is large enough that your links are safe for the entire campaign lifecycle.

For branded, long-lived business links

Use Business-tier 2-character slugs on a custom domain with password protection enabled. The short slug is easy to remember and share verbally. The custom domain obscures the shortener. The password ensures that even a lucky guess yields nothing.

Why This Matters for Privacy

Every short link is a potential data leak. The destination URL might contain query parameters with user IDs, session tokens, affiliate codes, or internal resource paths. If an attacker can enumerate your shortener's slugs, they can harvest all of that — silently, at scale, without triggering any alerts.

By deliberately pairing slug length with TTL and layering additional protections on short slugs, TraceNull ensures that the convenience of a short URL never comes at the cost of exposing your data. The slug length isn't arbitrary. It's a privacy decision — and we made it for you.