I briefly read about it, it says the method is similar to just converting numbers to hex (modulo + lookup in an 'alphabet', then shift, repeat until you are at

I briefly read about it, it says the method is similar to just converting numbers to hex (modulo + lookup in an 'alphabet', then shift, repeat until you are at zero), but with a shuffled alphabet. That doesn't sound secure _at all_ -- if an attacker can cause you to generate a bunch of IDs very quickly, it's likely that some of them will be sequential, and from there it should be easy to figure out what the shuffled alphabet was. Indeed, from hashids.org: > Do you have a question or comment that involves "security" and "hashids" in the same sentence? Don't use Hashids. and then they link to a blog post with a detailed analysis (which makes it look like their characterization as just converting a number to a shuffled alphabet doesn't capture all the details) demonstrating that it's weak.