If one is creating pseudo-random base 62 url paths, and one didn't want those paths to be reasonably vulnerable to brute force attack. How short could they be?
Now one could have expiring short urls and urls expecting to be read from a particular device key, and many other measures. Also I'm sure there are ways to sniff out a url as it routes its way around the internet. But I just want to set that aside to simplify the question towards what the minimum length of a url can be without it being fairly vulnerable to a brute force attack.
Of course, any url could be guessed at random, but if there are enough characters in a secret code then guessing that code can become almost impossible. For example, password length requirements often force users to pick longer passwords so that they can be hardened to certain brute force and/or guessing attacks. Most web servers or arrays of web servers can only respond so quickly to secret key requests, so there is generally an upper bound on how many attempts can be tried per second.
With a base 62 url path code, if my vague memory of math serves me, there are 62 to the N power possible path codes, where N is the length of the url path code. 4 characters is too short because that would only provide about 14 million codes, some popular web sites and applications have more users than that such that you wouldn't even be able to provide enough shortened urls. 6 characters seems popular among quickly expiring codes, but even that is pushing it if one had a lot of usages. On the other hand, a 100 character length code is probably unnecessarily large. A code that large seems both impossible to guess at random and difficult to brute force while providing more usages than most humans living on earth could find for a code of that length.
So that leads me to wonder where is a nice middle ground between 6 characters and 100 character length codes? What is a good minimum length for a base 62 url code? 16 characters?