Why shortened URLs are safe

The circumstance: Currently, we are conveying messages and SMS to our clients, which incorporate a connection to a structure that every client needs to finish up consistently (an “eDiary”). As the need might arise to have the option to confirm and approve the client likewise, we as of now append a jwt token as a question boundary to the connection as we need to make it as simple as workable for the clients, as relatively few of them are very well informed.

The issue with this is, that the connections will quite often be extremely lengthy along these lines, which makes it over the top expensive, as we’re conveying around five SMSes, out of which four are only for the connection.

Subsequently, we are presently searching for a method for shortening the connections in a protected manner. As the information that is being placed is exceptionally delicate, the connection should in any case be adequately secure, so it can not be speculated in a “short” measure of time. The connections are generally legitimate for a couple of days, as we can not “force” the client to enter the information in a more limited measure of time.

Subsequently, I am probable searching for a hashing calculation of sorts, that could be utilized in this situation, where the design of the connections is notable. We’ll obviously additionally restrict how much retries a client could do, prior to being briefly impeded by the framework, yet on the off chance that we’ll need to serve a great many connections, the possibilities will develop of speculating one at arbitrary.

The inquiry: What might be a decent split the difference between shortening the URL however much as could reasonably be expected, yet protecting the connection enough so “speculating” a particular connection is improbable for explicit clients as well concerning all clients (birthday assault).