It's not likely to be an identifier. It's most likely a base64-encoded JSON, or some other similar encoding, followed by an HMAC. Probably the encoded data incl

It's not likely to be an identifier. It's most likely a base64-encoded JSON, or some other similar encoding, followed by an HMAC. Probably the encoded data includes a nonce too, which is a largish random number. Why write something to a database if you can stick it in the url instead? When you stick it in the url it lasts exactly as long as a user is interested in it. If you stick it in a database and give out an identifier you then have to expire it out of the database some time later. This either disappoints users because you expired it too soon, or costs you to store it for longer than it was needed. The HMAC ensures that they can ignore any data that was modified by a curious hacker.