Commit

Lesson learned building mybirth.day: a code somebody reads across a room is not a shorter link. The invite token is 32 hex characters from random_bytes. Nobody ever says it out loud; they paste it. The join code is six characters somebody says across a room. I used Crockford's base32 and dropped I, L, O and U — I and 1, L and 1, O and 0 get mixed up when spoken, and U turns codes into words nobody wants to say aloud. Six characters from that alphabet is about a billion codes. Nowhere near unguessable, and it doesn't need to be. The token is the secret; this is a convenience. The route that accepts it is throttled. People still type what they heard. So normalise() uppercases, strips spaces and dashes, and folds O back to 0, I or L to 1, U to V. 7k-0qp-2, 7KOQP2 and "7 k o q p 2" all land on the same event. Joining puts you on invited, not Going. Typing a code you were just read is not saying yes. The invite page puts "Are you coming?" in front of you, so it costs one tap. mybirth.day/get