Sqids – Generate short unique IDs from numbers

Original Article ↗ Hacker News Discussion ↗

Sqids, a rebranded successor to Hashids, aims to turn integers into short, YouTube-style alphanumeric IDs with features like custom alphabets and profanity filtering. Commenters weigh its benefits against simpler approaches such as base62/base64, UUID/ULID, or custom Feistel-based schemes, questioning whether an extra dependency is justified for what is essentially a reversible, non-cryptographic encoding. A recurring concern is the evolving blocklist for “bad words,” which can change how IDs are encoded over time and risks inconsistency across languages and versions.

Language coverage & community model

  • Site lists many languages; only some are implemented, others are “skeleton” repos to gauge interest and invite contributions.
  • Some see this as clever community building and a good entry FOSS task; others find it initially confusing but note visual cues distinguish implemented vs. placeholder languages.
  • Click tracking on language badges is speculated as a way to prioritize ports.

Relationship to Hashids and other ID schemes

  • Sqids is essentially the successor/rebrand of Hashids, with similar goals: short, URL-friendly encodings of integers.
  • Compared against base64/base58/base36, nanoid, UUID/ULID, Crockford base32, and various custom schemes; many argue those are simpler and often “good enough.”
  • Some prefer format-preserving encryption or Feistel-based permutations over Sqids for hiding sequential IDs.

Profanity filtering & blocklists

  • Built-in blocklists draw heavy debate.
  • Concerns: lists are language-specific, incomplete, and hard to maintain; changing defaults can change encodings over time.
  • Library advises providing a custom blocklist to keep outputs stable; critics say this design is brittle and cross-language compatibility may diverge.
  • Alternative proposals: choose alphabets that make profanity impossible or unlikely (e.g., omit vowels and ambiguous characters) instead of filtering generated strings.

Uniqueness, stability, and algorithm design

  • Thread examines how Sqids guarantees collision-free mapping from arrays of integers to strings, including how it retries on bad words without breaking injectivity.
  • Important nuance: decoding is stable, but encoding of the same numbers can change if blocklists or configuration change; there is no guarantee of a single canonical ID unless you enforce one.

Security, obfuscation, and user IDs

  • Library explicitly says it’s not for security or hiding data; output is reversible with the alphabet.
  • Some people still frame it as a way to hide sequential IDs or user counts, which others call misleading or “security by obscurity.”
  • For hiding business metrics or preventing ID enumeration, commenters recommend random UUIDs, encrypted IDs, Feistel networks, or other cryptographic approaches instead.

Use cases, practicality, and alternatives

  • Supporters like Sqids for visually shorter, “YouTube-style” URLs and cross-language interoperability.
  • Skeptics note that for many apps, simple base-N encodings, slugs, or UUIDs are easier, already available, and avoid blocklist complexity.
  • Some question the need for a dedicated library at all, given that many use cases are “a few lines of code,” though others argue standardization and portability justify it.