Imagine a buyer pays for a digital product, but the download link is accessible to anyone who guesses the order ID. Or a one-time link ends up in a public chat, and the file is downloaded by hundreds of strangers. According to statistics, over 70% of digital goods leaks are linked to predictable or unprotected URLs. Such incidents stem from using direct file links or tokens generated without cryptographic strength. We solve this completely: we design and implement cryptographically strong unique link generation with brute-force protection, rotation, and monitoring. Our team has 10+ years of experience in secure solutions for digital goods and has delivered over 50 content protection projects.
Why Unique Links Are Critical for Digital Goods
A unique link is the primary access control mechanism. Unlike a direct file link, the token prevents guessing another purchase's URL and ties the download to a specific transaction. A cryptographically secure pseudorandom number generator (CSPRNG) ensures unpredictability: an attacker cannot derive the token from sequential numbers or timestamps. The definition of CSPRNG can be found on Wikipedia.
Minimum token requirements:
- entropy of at least 128 bits (32 bytes → 64 hex characters)
- uniqueness in the database (UNIQUE constraint + collision handling)
- URL part length no more than 64–80 characters
How We Generate Cryptographically Strong Tokens
We use a generator based on random_bytes() — in PHP it reads from /dev/urandom or CryptGenRandom. The result is converted to hex (64 characters). For short, readable links (SMS, QR), we apply Base62 with 16 characters (~95 bits entropy). Both approaches provide sufficient entropy for commercial use.
class DownloadTokenGenerator { public function generate(): string { return bin2hex(random_bytes(32)); } } class ShortTokenGenerator { private const ALPHABET = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'; public function generate(int $length = 16): string { $token = ''; $bytes = random_bytes($length); for ($i = 0; $i < $length; $i++) { $token .= self::ALPHABET[ord($bytes[$i]) % 62]; } return $token; } } Approach comparison:
| Parameter | Hex (64 chars) | Base62 (16 chars) |
|---|---|---|
| Entropy | 256 bits | 95 bits |
| URL length | 64 chars | 16 chars |
| Readability | Low (hex only) | High (digits+letters) |
| Use case | Default | SMS, QR codes |
How to Protect Against Token Brute-Forcing
Even a 256-bit token is vulnerable if an attacker can make millions of requests. We configure rate limiting with separate limits for viewing (30/min) and downloading (10/min). If 10 invalid tokens from one IP within an hour — automatic blocking. This is 1000× more effective than a single captcha on the download page. Additionally, we monitor anomalous activity: if one token is downloaded from multiple IPs, the system alerts a possible leak.
// Laravel route with throttle middleware Route::get('/dl/{token}', [DigitalDownloadController::class, 'show']) ->middleware(['throttle:30,1']); Route::get('/dl/{token}/get', [DigitalDownloadController::class, 'download']) ->middleware(['throttle:10,1']); How to Implement Rotation of Compromised Links
If a buyer reports a leaked link, we instantly invalidate the old token, generate a new one with the same limit and expiration, and send the buyer a notification. All rotations are logged — you always know who and when requested a replacement.
| Parameter | Old Token | New Token |
|---|---|---|
| Status | Revoked | Active |
| Counter | Frozen | Reset |
| Limit | As before | As before |
When to Use Signed URLs Instead of Storing Tokens
HMAC-signed URLs do not require storing a token in the database: the link itself contains the signature and time-to-live. This is ideal for mass distribution of corporate licenses where thousands of users receive the same link. However, revoking an individual link without changing the signing key is impossible. We help choose the optimal approach for your scenario.
Example of signed URL generation in Laravel:
use Illuminate\Support\Facades\URL; $signedUrl = URL::temporarySignedRoute( 'download', now()->addHours(24), ['file' => $fileId] ); Step-by-Step Implementation of Link Generation
- Security scheme design: choose CSPRNG or HMAC, define entropy, set up rate limiting.
- Token generation: implement hex/Base62 classes with database uniqueness checks.
- Integration with routing: throttle and signed middleware, controllers for verification and download.
- Rotation mechanism: token invalidation, new generation, user notification.
- Anomaly monitoring: log downloads, alert on suspicious activity.
What's Included in the Implementation
- Security scheme design (CSPRNG, HMAC, rate limiting)
- Token generation (hex/Base62) with uniqueness verification
- Routing with middleware (throttle, signed)
- Rotation mechanism with logging and notifications
- Anomaly monitoring (download from multiple IPs)
- Operation and maintenance documentation
Implementation Timeline and Cost
Basic generation with brute-force protection — 1–2 working days. Extended functionality (rotation, monitoring, signed URLs) — another 2 days. The implementation cost depends on integration complexity with your system. We will select the optimal solution within your budget. Preventing leaks pays for development costs after just 1000 downloads.
Get a consultation: describe your scenarios — we'll choose the optimal solution. Contact us to implement unique link generation turnkey, with guaranteed security and performance.