Is Hashids cryptographically secure?

No. Hashids is an obfuscation, not encryption. With enough samples and the right salt, the encoding can be reversed. Don't use it to protect anything sensitive — only to hide sequential IDs in URLs.

Can Hashids encode negative numbers or zero?

It encodes non-negative integers only (zero included on most implementations). For signed values, offset to a positive range before encoding.

Is the conversion done locally?

Yes. Hashids runs in your browser; your salt and IDs are not sent anywhere.

hashids · salt · reversible · local

Encode integers to opaque IDs

Reversibly hash positive integers into short, opaque strings — the YouTube / Bitly style. Salted and reversible with the same salt. Runs entirely in your browser.

Hashids Converter

Mode

encode

ints → id

Salt

—

none

Output

—

idle

Status

—

local

input · integers

Salt (optional)

Min length

Integers (space-separated)

output · hashid

Result will appear here…

Quick Start

How Hashids work

Hashids reversibly shuffles non-negative integers into a short alphabet-permuted string using a salt. Same salt + same ints → same output. No actual hashing involved.

01
Pick a salt
Anything secret. Required to make outputs project-unique.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
saltUTF-8TextEncoderlosslesslive
salt · raw bytessecret · UTF-8
```
my-project-salt
```
loaded · UTF-8MIME · ready
02
Set min length
Pads short outputs so they look uniform.
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
lengthWeb Cryptosubtledeterministiclive
min · options8 · live
```
min: 8
```
options applied · livelive
03
Encode integers
Space-separated positive integers → opaque string.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
encodememoisedoptionsinstantreactive
in · encoded1 2 3 · ready
```
o2fXhV
```
encoded · livelossless
04
Reverse with decode
Same salt + Hashid → original integers.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
decodeclipboardblobMIME-correctclient-side
ok · copiedreversed · done
```
o2fXhV → 1 2 3
```
done · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When to use Hashids

Hide DB IDs in URLs, short opaque tokens, public references.

Hide DB row IDs

Don't leak that you have 4 users in production. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Short URL slugs

YouTube-style 6–10 char IDs for shareable URLs. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Pack multiple ints

Encode (user_id, post_id) into one opaque string. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Sequential to opaque

Keep ints in the DB, expose Hashids on the wire. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Public references

Tickets, invoices, sharing links. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Vanity codes

Coupon codes that round-trip back to row IDs. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

Is Hashids cryptographic?

No — it's reversible obfuscation, not encryption. Treat the salt as semi-public; rely on real auth for security.

Can I encode multiple integers?

Yes. Encode an array (e.g. user_id and post_id) into a single short string.

Does the same int always produce the same output?

Only with the same salt and min length. Change either and the output changes.

Why no negative numbers?

Hashids is designed for non-negative integers (row IDs, counters). Use a sign bit or separate field for negative values.

Is anything sent to a server?

No. Hashids encode/decode locally via the hashids library — nothing leaves your browser, all runs locally.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!