Introduction
Need to expose numeric database IDs in URLs without making them sequential or guessable? Hashids is a library that encodes integers into short, URL-safe hash strings using a secret salt. The same salt and numbers always produce the same hash, but without the salt, the numbers cannot be recovered. This tool lets you encode numbers to HashIDs and decode them back, all in your browser. Paste your numbers below to generate a HashID.
What this tool does
- Encodes one or more integers into a compact HashID string using a configurable salt.
- Decodes HashID strings back to their original integer values using the same salt.
- Supports a minimum hash length parameter to ensure consistent output sizes.
- Uses the Hashids library (hashids on npm), which is compatible with implementations in JavaScript, Ruby, Python, PHP, Go, and other languages.
- Processes all data locally. No salt or numbers are transmitted to any server.
How this tool works
Enter a salt string in the salt field. The salt acts as a secret key that determines the encoding. In Encode mode, enter one or more comma-separated numbers (e.g., 42, 108, 7) and the tool outputs a HashID string. In Decode mode, paste a HashID string and the tool outputs the original numbers. Adjust the minimum hash length to ensure all generated hashes are at least a certain number of characters. The Swap button toggles between encode and decode modes and moves the output into the input field.
How Hashids encoding works
Hashids was created by Ivan Akimov as a lightweight library to generate YouTube-like hash strings from numbers. It is not a cryptographic hash function and should not be used for security purposes. The algorithm works by partitioning the input numbers using a separator character and shuffling the alphabet based on the salt. The alphabet used by default is `abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789` (62 characters). The salt determines the shuffling order, so different salts produce different hash strings for the same input numbers. The encoding process involves several steps: the salt is used to shuffle the alphabet, each number is encoded using a base-62 representation with the shuffled alphabet, and the results are joined with a separator character. A minimum hash length can be specified, and shorter hashes are padded with characters derived from the salt and the first number. The algorithm is deterministic: the same salt and input always produce the same output. However, without knowing the salt, it is computationally infeasible to recover the original numbers from the hash. Hashids is designed for obfuscation, not security. It prevents casual users from guessing sequential IDs in URLs (e.g., /users/1, /users/2 becomes /users/jR, /users/k5), but a determined attacker who can observe enough hash-to-ID mappings could potentially reverse-engineer the salt. For true security, use authenticated encryption or signed tokens. The library is available in multiple languages, making it possible to encode in one language and decode in another.
How to use this tool
- Enter a salt string in the salt field. This is your secret key. Keep it consistent across your application.
- Select Encode mode and enter comma-separated numbers (e.g., 42, 108, 7). The tool outputs a HashID string.
- To decode, select Decode mode and paste a HashID string. The tool outputs the original numbers.
- Adjust the minimum hash length if you need all hashes to be at least a certain number of characters.
- Use the Copy result button to copy the output to your clipboard.
Real-world examples
Obfuscating user IDs in URLs
Input numbers: `42`. With salt 'my secret salt', the output might be `NkK9`. Use this in URLs like `/users/NkK9` instead of `/users/42`. The same salt decodes `NkK9` back to `42`.
Encoding multiple IDs in a single hash
Input numbers: `1, 2, 3`. With salt 'app salt', the output might be `laHquq`. A single HashID can encode multiple numbers, useful for compound identifiers like user_id and post_id in a URL.
Decoding a HashID from a URL
Input: `NkK9`. Switch to Decode mode, enter the same salt used for encoding, and paste the hash. The tool outputs `42`. If the salt is wrong, the decode returns empty or incorrect values.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| Hashids | O(n) alphabet shuffling | URL ID obfuscation, non-sequential identifiers |
| UUID (v4) | Random 128-bit generation | Globally unique identifiers, no decoding needed |
| ULID | Timestamp + random, lexicographically sortable | Sortable unique IDs |
| Base62 encoding | O(n) base conversion | Converting numbers to short URL-safe strings (no salt) |
Limitations or considerations
Hashids is not encryption. It is an obfuscation tool designed to make sequential IDs non-guessable in URLs. The security depends entirely on the secrecy of the salt. If an attacker knows your salt, they can decode all your HashIDs. The library has a maximum integer size limitation depending on the implementation (JavaScript uses 53-bit integers safely). Hashids does not provide integrity verification or tamper detection. For security-sensitive applications, use signed tokens (JWT), HMAC-based identifiers, or authenticated encryption. The tool does not validate that decoded numbers are meaningful in your application context.
Frequently asked questions
Is Hashids secure?
No. Hashids is an obfuscation library, not a security tool. It hides sequential IDs from casual observation but can be reversed if the salt is known. Do not use it for authentication, authorization, or protecting sensitive data. Use proper encryption or signed tokens for those purposes.
Can I use the same HashID across different programming languages?
Yes. Hashids implementations exist for JavaScript, Python, Ruby, PHP, Go, Java, Lua, Clojure, Swift, and other languages. As long as you use the same salt, alphabet, and minimum hash length, the output will be identical across languages.
What happens if I use the wrong salt to decode?
The decode operation will return an empty array or incorrect numbers. There is no error message because the algorithm cannot distinguish between a wrong salt and a valid hash that happens to decode to different numbers with a different salt.
What is the maximum number I can encode?
The JavaScript implementation safely handles integers up to 2^53 (9007199254740992) due to JavaScript's number type. For larger numbers, use BigInt or a language-specific implementation that supports arbitrary-precision integers.
Conclusion
This HashID generator provides a convenient way to obfuscate numeric IDs for URLs using the Hashids library. It supports encoding and decoding with configurable salt and minimum hash length, all processed in your browser. For security-critical applications, use signed tokens or encryption instead. Check out the related Base62 encoder and UUID generator tools on this site.