cuid2

If you really need monotonic, secure/unguessable IDs, there are options like CUID2 (github.com/paralleldrive/cuid2). Older designs like ULIDs (https://github.com/ulid/spec) and Snowflake IDs (https://en.wikipedia.org/wiki/Snowflake_ID) have similar properties to UUIDv7, and potentially some advantages w.r.t. length/encoding/runtime cost/etc. But UUIDv7 has one key advantage none of those do: you can store them in a UUID-typed column or struct field without any lossy conversion. All of the UUID versions share a common size and serialization format, so it doesn't actually matter if you generate v1/4/7/etc. Many language standard libraries can generate them interchangeably, and (for example) a Postgres table can store any of the versions in the same column type. So yes, to the author's point(s): they are not magic, monotonic, un-guessable ID

This is first time I have experienced some vindication that choosing CUID2[1] for one of my projects was actually a good idea. 1. https://github.com/paralleldrive/cuid2

My understanding was that speed is not something you want in a UUID generator, since it makes it more susceptible to brute force attacks. Is this not the case? I've been using Cuid2[1] in most of my personal projects (this Go implementation[2], actually), which is fast enough, but not "too fast". It's also secure, collision resistant, and has everything I would need from a UUID. [1]: https://github.com/paralleldrive/cuid2 [2]: https://github.com/nrednav/cuid2

I saw this after installing the Temporal.io client: https://github.com/paralleldrive/cuid2 What should I use for a startup going after B2B sales? ULIDs or CUID2s for primary keys? I remember seeing Hussein Nasser's Shopify video: https://www.youtube.com/watch?v=f53-Iw_5ucA And it made me switch to using ULIDs instead. I know this may fall into the "premature optimization is the root of all evils" category. But since it's straightforward, what should I do? I've been using ULIDs in distributed systems with no problems so far.

Or, just use cuid2 [1] + prefix. [1] https://github.com/paralleldrive/cuid2

The CUID readme [1] explains that there's no real point to K-sortable on modern hardware: [1] https://github.com/paralleldrive/cuid2?tab=readme-ov-file#no...

There's a comparison in the README of the project: https://github.com/paralleldrive/cuid2#the-contenders Some of the arguments mentioned are explained elsewhere in the README, others are assumed. One argument standing out for me is the lack of collision-resistance for UUIDv4 which is surprising for me and I didn't spot any sources for that argument. Another argument is the entropy source where they go about that Math.random is not reliable as a single entropy source but glimpsing at the source code, they sprinkle the CUID with Math.random data. I am no expert in ID security, so I am not qualified to speak about the validity of their arguments, only that there's insufficient information to validate without prior knowledge about the problem domain.

I'm a fan of Cuid2[1] for this reason. They are compact, don't leak information, and make a good case why k-sortable IDs are unnecessary, or even harmful for performance. I'm using sequential integers and created_at/updated_at timestamps for internal use, and Cuid2 IDs externally. [1]: https://github.com/paralleldrive/cuid2

I'm recently finding Cuid2 to be the best of these alternative GUIDs. They seem to have all of the benefits for what you would want to use a GUID for, but none of the drawbacks of existing implementations.[1] [1]: https://github.com/paralleldrive/cuid2#comparisons

cuid [0] seems to be a random letter, concatenated with a sha3 hash of: - the system time - a process-global singleton counter (incrementing with each ID) - a "salt" derived from some number of bytes taken from an entropy source - a "fingerprint" of some number of bytes taken from the same entropy source this is an awful lot of work to be doing for each ID, to what end? well issue 7 [1] says that > Cuid2 is good when you need something secure, extremely collision resistant, and your system is distributed or decentralized (e.g. you want to be able to create records with ids on the client side), or you are building software that may need to scale horizontally). but I'm not sure how cuid as implemented provides a better answer in any of these dimensions to a plain old UUID maybe I'm just being cynical, I dunno [0] https://github.com/parallel

I see ulid and nanoid being recommended here. I like cuid2 based on input from its README [0] and discussion [1] [0] https://github.com/paralleldrive/cuid2 [1] https://github.com/paralleldrive/cuid2/issues/7