Hashids

Hashids is a small open-source library that generates short, unique, non-sequential ids from numbers.

It converts numbers like 347 into strings like “yr8”, or array of numbers like [27, 986] into “3kTMd”.

You can also decode those ids back. This is useful in bundling several parameters into one or simply using them as short UIDs.

check out the demo

Are you also using Hashids? Add your project.

ActionScript version

var hashids:Hashids = new Hashids("this is my salt");
var id:String = hashids.encode(1, 2, 3);
var numbers:Vector.<Number> = hashids.decode(id);

github repo
download

Implemented by Jovan Nikolić — https://github.com/jovanpn/hashids.as

Features

Create short unique ids from numbers (positive numbers & zero).
Allow custom alphabet as well as salt — so ids are unique only to you.
Incremental input is mangled to stay unguessable.
Code is tiny (~350 lines), fast and does not depend on external libraries.

How does it work?

Hashids works similarly to the way integers are converted to hex, but with a few exceptions:

The alphabet is not base16, but base base62 by default.
The alphabet is also shuffled based on salt.

This JavaScript function shows regular conversion of integers to hex. It's part of Hashids (although this is a modified example):

JavaScriptfunction toHex(input) {

  var hash = "",
    alphabet = "0123456789abcdef",
    alphabetLength = alphabet.length;

  do {
    hash = alphabet[input % alphabetLength] + hash;
    input = parseInt(input / alphabetLength, 10);
  } while (input);

  return hash;

}

If we try to convert integer 1234 to hex with toHex(1234), we will get back "4d2".

If we increase the alphabet to abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890, our output will now be shorter because there's more characters to work with — so it becomes "t5".

If we take it one step further and shuffle the alphabet before encoding, we will get a different value. But how could we shuffle the alphabet consistently, so that with every shuffle the characters would keep the same order?

That's where Hashids uses a variation of Fisher-Yates algorithm:

JavaScriptfunction consistentShuffle(alphabet, salt) {

  var integer, j, temp, i, v, p;

  for (i = alphabet.length - 1, v = 0, p = 0; i > 0; i--, v++) {

    v %= salt.length;
    p += integer = salt[v].charCodeAt(0);
    j = (integer + v + p) % i;

    temp = alphabet[j];
    alphabet = alphabet.substr(0, j) + alphabet[i] + alphabet.substr(j + 1);
    alphabet = alphabet.substr(0, i) + temp + alphabet.substr(i + 1);

  }

  return alphabet;

}

The code above might look complicated, but it does one simple thing — shuffles the alphabet based on user's salt.

That way when one user passes the salt "abc1", our alphabet becomes cUpI6isqCa0brWZnJA8wNTzDHEtLXOYgh5fQm2uRj4deM91oB7FkSGKxvyVP3l

And when another user passes "abc2", the alphabet becomes tRvkhHx0ZefcF46YuaAqGLDKgM1W5Vp2T8n9s7BSoCjiQOdrEbJmUINywzXP3l

You can see that the shuffle is pretty good even when salt value is not that much different. This is what makes the base of Hashids work. Now we are able to encode one integer based on the salt value the user provides.

But Hashids is able to encode several integers into one id. This is done by reserving a few characters from the alphabet as separators. These characters are not used in encoding, but instead do the job of purely separating the real encoded values.

Let's say we encoded 1, 2, 3 without the salt and got "o2fXhV". Actual values in this output are highlighted: o2fXhV. Letters "f" and "h" are simply used as separators.

Letter "o" in this case is reserved for another type of job - it acts as a lottery character to randomize incremental input. If we encode numbers as we increment them, the output is somewhat predictable:

Input	Output
1, 2, 3	2fXhV
1, 2, 4	2fXhd
1, 2, 5	2fXh6
1, 2, 6	2fXhz
1, 2, 7	2fXhR

So the lottery character is used to do another iteration of consistent shuffle, before starting the actual encoding. The ids then end up looking more random (with a tiny disadvantage of having that extra lottery character):

Input	Output
1, 2, 3	o2fXhV
1, 2, 4	pYfzhG
1, 2, 5	qxfOhN
1, 2, 6	rkfAhN
1, 2, 7	v2fWhy

This is a quick overview of how Hashids is structured. Decoding is done the same way but in reverse — of course in order for that to work, Hashids itself needs the salt value from you in order to decode ids correctly.

If you give Hashids the wrong salt and it just so happens that it decodes back to some random integers, Hashids does a quick check by encoding those integers to be sure the initial id matches. If it does not, the integers are discarded.

#%@&$!!11

bouncercat awesomed by cameronmcefee

We need ids to be nice and friendly especially if they end up being in the URL.

Therefore, the algorithm tries to avoid generating most common English curse words by never placing the following letters (and their uppercase equivalents) next to each other:

c, s, f, h, u, i, t

This is done by using them as separators.

Are there any alternatives?

Yes, there are a few and you should pick the most appropriate for the job. Hashids is not perfect for everything.

Base64 encode. This is the most straightforward approach — most languages have these functions. If you don't need all the fancy extras Hashids has to offer, this method will work just fine. It'll probably be faster too. Read more.
Generate ids based on timestamp. If you can afford certain degree of collisions, you could compose an id that's built on the fly. Use a counter (if you have one) + timestamp (even better if in milliseconds) + some system value (either an IP address or some machine id) + a random integer. Many big companies implement this approach because it works well in distributed systems. These ids are generated independently of each other and the risk of collisions is so tiny it's negligible.
If you need your ids to consist of only numbers, check out Optimus. It's based on Knuth's integer hash method and produces obfuscated integer ids (and does it faster too). There are PHP and Go implementations.
Nano ID. Check out Nano ID, it's available for several languages as well.
Check out how others do it:
- How does Instagram generate ids?

What not to do

Do not try to encode negative numbers. It won't work. The library currently supports only positive numbers and zero. If you're trying to use numbers as flags for something, simply designate the first N number of digits as internal flags.
Do not encode strings. We've had several requests to add this feature — "it seems so easy to add". We will not add this feature for security purposes, doing so encourages people to encode sensitive data, like passwords. This is the wrong tool for that.
Do not encode sensitive data. This includes sensitive integers, like numeric passwords or PIN numbers. This is not a true encryption algorithm. There are people that dedicate their lives to cryptography and there are plenty of more appropriate algorithms: bcrypt, md5, aes, sha1, blowfish. Here's a full list.

Collisions

There are no collisions because the method is based on integer to hex conversion. As long as you don't change constructor arguments midway, the generated output will stay unique to your salt.

Additionally, we encourage you to pre-generate a large number of ids for testing purposes — to analyze their uniqueness, whether they look random enough for your project and what your upper integer limit is (which usually depends on your system/language).

Please note that generated ids are case-sensitive by default ("Aaa" is not the same id as "aaa").

Why "hashids"?

Originally the project referred to generated ids as hashes, and obviously the name hashids has the word hash in it. Technically, these generated ids cannot be called hashes since a cryptographic hash has one-way mapping (cannot be decrypted).

However, when people search for a solution, like a "youtube hash" or "bitly short id", they usually don't really care of the technical details. So hashids stuck as a term — an algorithm to obfuscate numbers.

Decoding without salt

Do you have a question or comment that involves "security" and "hashids" in the same sentence? Don't use Hashids. Here are some ways to decode:

Use a brute-force attack. These ids are short, get a big dictionary and this shouldn't be too hard.
Use an even faster method with this blog post.

How to contribute

If you've found a bug, please open a github issue in the appropriate repository. Bonus points if you submit a pull request with it.

If an implementation in your favorite language is missing, feel free to port it over from one of the existing versions. There's still plenty of languages to contribute in: Nu, Groovy, Racket, Scheme, Tcl, Dylan, Lolcode, Factor?

We try to keep the library versions compatible. If you see an outdated version in an existing implementation, please open a github issue in that repository — show your +1 support for that issue.

codercat by cameronmcefee

Are you using Hashids?

Whether it's an open-source project or a commercial product, tell us at https://github.com/hashids/hashids.github.io/wiki/Who's-Using-Hashids !

Hashids elsewhere

If you have a question about Hashids, a lot has already been answered. Try checking one of these:

Maintainers

Many thanks to the numerous folks that have implemented the different versions, plugins, extensions as well as to those that have suggested general improvements.