diff --git a/internal/secret/id.go b/internal/secret/id.go
new file mode 100644
index 00000000..1b47ece0
--- /dev/null
+++ b/internal/secret/id.go
@@ -0,0 +1,30 @@
+package secret
+
+import (
+	"crypto/rand"
+	"fmt"
+	"math/big"
+)
+
+// NewID generates a unique 128-bit random ID as a hex-encoded string.
+func NewID() (string, error) {
+	if s, err := New(16); err != nil {
+		return "", err
+	} else {
+		return s.String(), nil
+	}
+}
+
+// RandomAlphaNumeric generates a random string of the specified length using the characters [a-z0-9].
+func RandomAlphaNumeric(length int) (string, error) {
+	const charSet = "abcdefghijklmnopqrstuvwxyz0123456789"
+	s := make([]byte, length)
+	for i := range s {
+		randIdx, err := rand.Int(rand.Reader, big.NewInt(int64(len(charSet))))
+		if err != nil {
+			return "", fmt.Errorf("get random number: %w", err)
+		}
+		s[i] = charSet[randIdx.Int64()]
+	}
+	return string(s), nil
+}
diff --git a/internal/secret/secret.go b/internal/secret/secret.go
index 1d8c62ac..bfd70a85 100644
--- a/internal/secret/secret.go
+++ b/internal/secret/secret.go
@@ -54,11 +54,3 @@ func New(len int) (Secret, error) {
 	}
 	return s, nil
 }
-
-func NewID() (string, error) {
-	if s, err := New(16); err != nil {
-		return "", err
-	} else {
-		return s.String(), nil
-	}
-}