cuid

cuid generates short, URL-safe, sequentially-sortable unique identifiers by combining a fixed prefix, a timestamp, a per-process counter, a machine fingerprint, and random blocks — designed for fast database lookups and recency sorting across horizontally-scaled systems. The project’s own maintainers have since deprecated it: because cuid values embed an exact timestamp and use a predictable counter, they can leak information and are more guessable than a properly random identifier, so the README now directs new projects to Cuid2 instead. The original package remains widely installed in existing codebases that adopted it before the deprecation.

What You Get

• A zero-configuration cuid() function that returns a new collision-resistant ID string on each call
• IDs that sort roughly by creation time, improving database index locality compared to fully random UUIDs
• Cross-environment builds for Node.js, browsers, and React Native via separate fingerprint/random-value implementations
• A cuid.isCuid() helper and cuid.slug() variant for generating shorter, less unique identifiers

Common Use Cases

• Generating primary keys or record IDs in legacy applications that adopted cuid before its deprecation
• Producing sortable, index-friendly identifiers where sequential insert locality mattered more than unguessability
• Maintaining backward compatibility with existing databases or APIs whose ID format is already cuid-shaped
• Generating client-side element or component IDs in browser code without a server round-trip

Under The Hood

Architecture - index.js (84 lines) composes an ID from five parts: a hard-coded leading letter c (for HTML-ID safety), a base-36 timestamp, a safeCounter() block that increments per call and wraps at 36^4, a machine fingerprint(), and two random blocks; environment-specific behavior is isolated into lib/fingerprint.js/lib/getRandomValue.js with .browser.js and .react-native.js variants selected via the browser field in package.json, so the same cuid() call produces environment-appropriate fingerprints (PID+hostname hash in Node, lib/fingerprint.browser.js in the browser) without conditional logic in the core module. Tech Stack - Plain CommonJS JavaScript with no runtime dependencies; the dev toolchain uses Browserify/Watchify for browser bundling, Tape and Riteway for testing, TestCafé for cross-browser test automation, and ESLint for linting. Code Quality - test/test.js and test/getRandomValue.test.js cover ID generation and randomness, with test/browser.js and a test/worker/ harness exercising the browser and Web Worker builds specifically; the fingerprint implementation (lib/fingerprint.js) hashes the hostname by summing character codes, a simple but low-entropy technique the maintainers themselves later cited as part of why the design was deprecated. API Design - The entire public API is a single zero-argument cuid() call plus a cuid.slug() variant, which makes it trivially easy to adopt, but the README’s prominent ‘Status: Deprecated due to security’ banner and its own security writeup on timestamp/counter leakage mean new adopters are explicitly steered toward Cuid2 instead.