- How do I install deligoez/laravel-model-hashids in a Laravel app?
- Install it with Composer using composer require deligoez/laravel-model-hashids. Laravel's package auto-discovery registers the service provider, so no manual provider entry is needed. Run php artisan vendor:publish to publish the config file, then set your own salt before generating any hashids. Confirm your runtime meets the PHP 8.3 or 8.4 requirement first.
- How do I add hashids to an Eloquent model?
- Add the package's trait to the model you want to obfuscate, for example use HasHashid; in the class body. The trait generates and saves a short hashid for the record and exposes it for URLs and API output. You keep your normal integer primary key, so no migrations to change existing keys are required beyond the column the package expects. Apply it selectively rather than to every model, since only exposed identifiers need obfuscation.
- Which Laravel and PHP versions does laravel-model-hashids support?
- Version 4.1.0 supports Laravel 11, 12 and 13 concurrently and requires PHP 8.3 or 8.4. That overlapping support window means a single package version serves an application fleet that is mid-upgrade between Laravel majors. Check your base Docker images and CI runners for PHP 8.3+ before committing.
- How do I configure the hashids salt, minimum length and alphabet?
- Configuration lives in the published config file, where you set the salt, the minimum hash length and the character alphabet used for encoding. The salt is application-owned, so store it as a secret in your environment rather than committing it to the repository. Changing these values changes the output, so treat salt and alphabet as durable settings under change control. Longer minimum lengths reduce the chance of collisions across large tables.
- Does route model binding work automatically with hashids?
- Yes. The package provides automatic route resolution so a hashid segment in the URL resolves back to the correct Eloquent model instance. You typically override the model's route key so generated URLs emit the hashid instead of the integer key. Verify redirects, cached URLs and pagination links after enabling it, since those are the places stale integer IDs tend to linger.
- Are hashids secure enough to protect records from unauthorised access?
- No. Hashids are obfuscation, not authorisation, and a leaked salt makes every hash reversible. They stop casual enumeration of sequential IDs in URLs and exports, but every access-control check must still happen server-side. If your actual requirement is unguessable tokens rather than short readable IDs, use ULIDs or UUIDs instead.
- Does this package replace my integer primary keys in the database?
- No, your integer primary keys stay exactly as they are and all internal joins keep using them. The hashid is an additional public-facing representation used for routes, API responses and shared links. That design keeps foreign keys and query performance unchanged. It also means any model you expose needs the trait plus a route key override to be consistent.
- What happens if I rotate or change the hashids salt?
- Every previously issued hashid stops decoding, so all shared links, bookmarked URLs and stored hashes in downstream systems break at once. Treat the salt as a durable secret with an explicit change-control gate rather than a routine config edit. A missing or wrong salt produces the same symptom: 404s across every affected link. If you must rotate, plan a migration window and audit consumers that persisted old hashid strings.
- What are the alternatives to laravel-model-hashids?
- If you need genuinely unguessable identifiers, use ULIDs or UUIDs via Laravel's native HasUniqueStringIds or HasUuids traits. If you want short IDs without a package, Hashids is a small algorithm you can wrap yourself in a few days. If you only need prettier URLs, a slug package may fit better. This package suits teams that want obfuscated, short, integer-derived IDs with route resolution already wired up.
- What should I watch out for in production and testing?
- Test route resolution, API resource output and any cached or exported hashid strings, and be aware that rotating the salt is a breaking change. The package is a thin, pure-PHP wrapper over Hashids with no network hop or external state, so runtime cost is negligible outside heavy serialization loops. Community OSS support has no SLA, so document an exit plan: replacing it in-house is measured in days. Do not let it become load-bearing without that fallback written down.