CUID2 Generator
Generate cryptographically secure, collision-resistant identifiers. CUID2 offers enhanced security with configurable length for modern applications.
About CUID2
CUID2 is the evolution of the original CUID, designed from the ground up with security as a primary concern. Created by Eric Elliott and the Parallel Drive team, CUID2 addresses several security limitations of the original format.
Key Features
- Cryptographically Secure - Uses secure random number generation
- No Predictable Patterns - IDs don't reveal creation order
- Configurable Length - Choose from 2 to 32 characters
- Enhanced Entropy - Better distribution of randomness
- URL Safe - Only lowercase letters and numbers
When to Use CUID2
- Public database record identifiers
- IDs generated by offline clients or multiple application nodes
- URL slugs where lowercase alphanumeric output is useful
- Any scenario where leaking creation time from an ID is undesirable
For session tokens, API keys, and password reset links, use a dedicated token design with expiry, revocation, secure storage, and authorization checks.
Length Recommendations
| Length | Use Case |
|---|---|
| 24 (default) | Most applications - excellent balance of size and uniqueness |
| 32 (max) | High-security tokens, extreme-scale systems |
| 16-20 | URL slugs where brevity matters, lower-volume systems |
Frequently Asked Questions
What is CUID2?
CUID2 is the second generation of collision-resistant unique identifiers. Designed to address security concerns in the original CUID, it uses cryptographically secure random number generation to eliminate predictable patterns.
What are the differences between CUID2 and CUID?
CUID2 hashes multiple entropy sources, including time, random values, a counter, and a host fingerprint, into an opaque result. Unlike CUID v1, its timestamp and other inputs cannot be extracted from the output. CUID2 also supports a configurable length of two to 32 characters.
Why can't I extract a timestamp from CUID2?
Unlike CUID v1, CUID2 mixes its timestamp input with other entropy through a cryptographic hash, so the original time is not recoverable. Store an explicit created_at field whenever your application needs creation time.
What length should I use for CUID2?
The default length of 24 characters offers excellent collision resistance for most applications. Use longer lengths (up to 32 characters) for extremely high-volume systems or when extra uniqueness is required. Shorter lengths are available, but they reduce collision resistance (minimum 2).
Is CUID2 suitable for security tokens?
CUID2 is designed to produce hard-to-guess identifiers, but credentials such as session tokens, API keys, and reset links also require lifecycle controls, secure storage, expiry, and revocation. Prefer a dedicated token design and do not use identifier opacity as authorization.