Moving away from UUIDs – Neil Madden

Madden has a delightful post going into depth on the "guessability" of UUIDs. UUIDs are used all over the place in so many systems. They solve a really important issue for programmers, creating a (nearly) guaranteed random number.

But Madden goes to work to see how long it would take to guess a UUID and, uh oh, it could be 35 minutes.

My recommendation is to use a 160-bit (20 byte) random value that is then URL-safe base64-encoded. The URL-safe base64 variant can be used pretty much anywhere, and is reasonably compact.

That takes 17.9 million years to guess. More than 35 minutes… 🤓