title: Human Readable GUID
body: <p>I'm writing a small system that will allow me to sell my band's music at gigs by generating vouchers that can be redeemed for MP3s at our website.</p>
  
  <p>The vouchers will need a code that the user types in.  The code needs to have the following qualities:</p>
  
  <ol>
  <li>Some level of human readability in terms of length and content, to prevent user frustration and data entry error.</li>
  <li>Given one voucher code, not trivial to guess another voucher code.</li>
  </ol>
  
  <p>If I use GUIDs I'm concerned about point 1.  If I use an incrementing integer I'm concerned about point 2.  There has to be some happy medium in between, right?  I thought perhaps this work has already been done and there's an ideal solution waiting out there for me.  In the absence of that, I'm thinking I'll go with a random alphanumeric string, or possibly letters only (excluding I and O for clarity), and have the application block IP addresses that fail X number of times, which would indicate a possible brute force attack.  If I went with that, how long of a string and what value of X would work, and why?</p>
  
  <p>Thanks for your help!</p>
  
  <hr>
  
  <p>Update: I wasn't totally explicit about the method: I will generate lists of voucher codes for printing, then enter the "sold" codes after a gig.  Therefore I think elements like a checksum are not necessary like they are in software keys that don't use validation servers.</p>