safe enough 8-character short unique random string
cryptography, hash, python, random
Solution
Is there a reason you can't use `tempfile` to generate the names?
Functions like `mkstemp` and `NamedTemporaryFile` are absolutely guaranteed to give you unique names; nothing based on random bytes is going to give you that.
If for some reason you don't actually want the file created yet (e.g., you're generating filenames to be used on some remote server or something), you can't be perfectly safe, but `mktemp` is still safer than random names.
Or just keep a 48-bit counter stored in some "global enough" location, so you guarantee going through the full cycle of names before a collision, and you also guarantee knowing when a collision is going to happen.
They're all safer, and simpler, and much more efficient than reading `urandom` and doing an `md5`.
If you really do want to generate random names, `''.join(random.choice(my_charset) for _ in range(8))` is also going to be simpler than what you're doing, and more efficient. Even `urlsafe_b64encode(os.urandom(6))` is just as random as the MD5 hash, and simpler and more efficient.
The only benefit of the cryptographic randomness and/or cryptographic hash function is in avoiding predictability. If that's not an issue for you, why pay for it? And if you do need to avoid predictability, you almost certainly need to avoid races and other much simpler attacks, so avoiding `mkstemp` or `NamedTemporaryFile` is a very bad idea.
Not to mention that, as Root points out in a comment, if you need security, MD5 doesn't actually provide it.
Problem
I am trying to compute 8-character short unique random filenames for, let's say, thousands of files without probable name collision. Is this method safe enough? ``` base64.urlsafe_b64encode(hashlib.md5(os.urandom(128)).digest())[:8] ``` Edit To be clearer, I am trying to achieve simplest possible obfuscation of filenames being uploaded to a storage. I figured out that 8-character string, random enough, would be very efficient and simple way to store tens of thousands of files without probable collision, when implemented right. I don't need guaranteed uniqueness, only high-enough improbability of name collision (talking about only thousands of names). Files are being stored in concurrent environment, so incrementing shared counter is achievable, but complicated. Storing counter in database would be inefficient. I am also facing the fact that random() under some circumstances returns same pseudorandom sequences in different processes.