Hashids is a PHP library that generates YouTube-like obfuscated identifiers from numeric database IDs.
The problem Hashids solves is the need to hide sequential database IDs from users while maintaining the ability to decode them back. Rather than using encryption, it encodes numbers into short, random-looking alphanumeric strings. The library uses a configurable alphabet and supports options like custom salts for uniqueness, padding to enforce minimum output length, and encoding of hexadecimal values such as MongoDB ObjectIds. It avoids generating common English curse words by preventing certain letter combinations in output.
Hashids suits projects where you need to expose IDs in URLs or user-facing contexts but want to obscure the underlying numeric sequence. It works well for generating shareable links, public identifiers, or any scenario where sequential IDs would reveal information about your data volume or structure. The library requires either the bcmath or gmp PHP extension. Developers should be aware that decoding always returns an array of numbers even for single-value encoding, negative numbers are not supported, and invalid input returns an empty string. Critically, Hashids is not an encryption library and should never be used to protect sensitive data; it is purely an obfuscation tool. The creator has released an upgraded successor called Sqids, though Hashids remains maintained for continued use.
The project maintains active support for the library despite the existence of its successor. The codebase handles edge cases like encoding hex values without size limits and generating non-patterned output across multiple identical or sequential inputs. Documentation explicitly warns against misuse as a security mechanism and clarifies the distinction between obfuscation and encryption.
