Currently, generated library names are 6 hex digits, encoded from 3 bytes of information generated by os.urandom(). This level of security is appropriate for a shared secret but not necessary for a library name, which will be served to the public. Using the full alphabet instead of hex digits will also let libraries visually distinguish their short name from their shared secret (which is nothing but hex digits).

I originally thought that 6 hex digits wasn't enough to represent all the libraries we'd need, but it does allow for 16,777,216, which is plenty. So this isn't as high priority as I originally thought. However, using the full alphabet lets us represent 308,915,776 libraries, and the chance of a collision is much lower.