- How do I install bvtterfly/laravel-hashids in a Laravel application?
- Install it with Composer using composer require bvtterfly/laravel-hashids. The service provider and facade are auto-discovered, so no manual registration is needed on supported Laravel versions. Publish the config file with the package's publish command and set your salt, minimum length, and alphabet there. Because the repository is archived, pin the version explicitly in composer.json.
- Which Laravel and PHP versions does laravel-hashids support?
- The last release, v1.1.0 from March 2023, added PHP 8.2 and Laravel 10 support, which is the declared ceiling. There is no evidence of Laravel 11 or 12 compatibility, and an archived repository cannot ship a compatibility bump. If you adopt it on a newer framework you will need to fork it and maintain the compatibility yourself.
- Is Hashids encryption? Can I rely on it to hide IDs securely?
- No. Hashids is a reversible, salt-keyed encoding, not encryption, and anyone who obtains the salt can decode every ID you have ever issued. Treat it as a cosmetic or anti-scraping measure that keeps database keys out of URLs and API payloads, never as an access control. Authorisation must be enforced separately, and any endpoint that decodes a user-supplied string should sit behind rate limiting.
- How do I use laravel-hashids with route model binding and URL generation?
- Encode the model key when generating URLs and decode the incoming segment before resolving the record. A common approach is to add an accessor or a getRouteKey method that returns the encoded value, then override route binding to decode and look up the model, returning a 404 when decoding yields nothing. Keep the encoding at the HTTP presentation boundary so internal code continues to use plain integer keys.
- What happens if I change the salt, minLength, or alphabet later?
- Any change to the salt, minimum length, or alphabet re-encodes the entire ID space, so every previously issued URL, email link, sitemap entry, and outbound integration reference breaks with no migration path. Treat these values as fixed encoding parameters rather than tunables. Choose a deliberate minimum length up front and plan any rotation as a coordinated, breaking change.
- Can I configure different Hashids settings per database connection?
- Yes, the package supports per-connection configuration of salts and encoding parameters. Be careful, though, because the same database row can then present different public identifiers depending on which binding was used. Misconfiguration is silent: you get a valid-looking hash that decodes to the wrong record or to nothing, so add round-trip tests for every connection.
- Is laravel-hashids still maintained and safe for production use?
- The GitHub repository is archived, the last release was v1.1.0 in March 2023, and it has roughly 28 stars, so there is no meaningful community or upstream patch path. It is technically trivial to install and use, but production adoption means forking or vendoring it and owning it indefinitely. On a long-lived product, budget for every future Laravel upgrade becoming a fork-and-patch exercise.
- How should I store and protect the Hashids salt?
- Keep the salt in an environment variable rather than committing the published config file, which is easy to leak into git, a shared wiki, or a container image. The salt is a secret with a large blast radius: if it leaks, every ID in logs, emails, sitemaps, and integrations becomes trivially decodable. Rotating it also invalidates all previously issued URLs, so guard it like a credential from day one.
- How do I write tests for code that uses laravel-hashids?
- Set a deterministic salt, minimum length, and alphabet in your testing environment so encoded output is stable across runs. Assert encode and decode round-trips for known IDs rather than hardcoding specific hash strings, since any config change silently alters every output. Also test the failure path where decoding an invalid or tampered string returns null or an empty result.
- What are the alternatives to bvtterfly/laravel-hashids?
- You can use the underlying hashids PHP library directly with a small first-party service, which removes the abandoned wrapper from your dependency tree. Sqids is the successor project by the same author, and Vinkla/hashids is a longer-standing Laravel wrapper. If the real requirement is unguessable identifiers rather than short pretty URLs, UUIDs or ULIDs stored as the public key are the safer choice.