From this MSDN link
"The ASP.NET session identifier is a randomly generated number encoded into a 24-character string consisting of lowercase characters from a to z and numbers from 0 to 5."
So, the answer: Yes, and it is safe for file names and query strings
Prashanth thurairatnam
source share