Just generate a random string (make sure to use the proper generator, e.g. https://gist.github.com/dchest/751fd00ee417c947c252 https://gist.github.com/dchest/75

Just generate a random string (make sure to use the proper generator, e.g. https://gist.github.com/dchest/751fd00ee417c947c252 https://gist.github.com/dchest/751fd00ee417c947c252). If the result is shorter than, say 100 bits, you'll have to check for collisions (e.g. unique constraint in database). Alternatively, if you have 64-bit sequences as IDs (e.g. autoincremented ids in SQL database), you can encrypt then using a real 64-bit block cipher, such as Blowfish or XTEA, with a secret key known only to server. This can give you unsigned 64-bit numbers, which are usable in existing systems (except in JavaScript, where maximum integer has 53 bits), for example: 1 -> 3491820675944448233 2 -> 9264994595240464886 If you use base64 encoding, it will give you 11-character strings, e.g. "0AdUgU8OZfo". Make sure to use URL-safe encoding, though (instead of +, / it uses -, _).