Weave Code
Sqids For Laravel Laravel Package
guava/sqids-for-laravel
Generate short, YouTube-style unique IDs from numbers in Laravel. This package wraps Sqids with a facade, configuration, validation rules, and Eloquent helpers so you can encode and decode IDs cleanly across your app.
This is a laravel wrapper for sqids.
Frequently asked questions about Sqids For Laravel
- How do I install guava/sqids-for-laravel?
- Install it with composer require guava/sqids-for-laravel. Laravel package auto-discovery registers the service provider and Sqids facade, so no manual wiring is needed. If you want to customize the alphabet, minimum length, or blocklist, publish the config file with php artisan vendor:publish. After that you can call the facade, use the trait on a model, or use the validation rule immediately.
- Which Laravel and PHP versions does sqids-for-laravel support?
- The package is a thin wrapper over sqids/sqids and targets supported Laravel releases, with version 1.2.0 widening the illuminate/* constraints to include Laravel 12. Laravel 10 and 11 applications are covered as well, though older releases may need to pin 1.1.x depending on constraints. Always check the composer.json of the tagged release you install and confirm your PHP version matches the sqids/sqids core requirement.
- How do I encode and decode a number with the Sqids facade in Laravel?
- Use the Sqids facade to encode an integer into a short string and to decode it back. encode() takes a number or an array of numbers, which lets you build composite tokens like encode([$tenantId, $orderId]). decode() always returns an array, so check that it is not empty before trusting the result. This makes the facade safe to use at API resource boundaries and in controllers.
- Are Sqids secure? Can someone guess or decode my IDs?
- No. Sqids are reversible obfuscation, not encryption: anyone who knows the alphabet and minimum length can decode an ID back to its number. The package is a UX and presentation utility, so it should never replace authorization checks. Treat the encoded ID purely as a nicer-looking public identifier and keep enforcing access control with your existing policies and gates.
- How does the HasSqids trait work with Eloquent route model binding?
- Adding the HasSqids trait to a model makes getRouteKey() return the encoded form, so URLs generated with route() automatically contain the Sqid. Laravel then resolves inbound route parameters by decoding the value and querying the underlying integer key. This keeps controllers clean because you do not need to sprinkle facade calls through every action. Note that an invalid value decodes to an empty array, so uncontrolled decode results should still lead to a 404 rather than a database lookup.
- Can I customize the Sqids alphabet, minimum length, and blocklist?
- Yes. The configuration is publishable and exposes the alphabet, min_length, and blocklist options used by the underlying sqids/sqids encoder. Because the encoder is resolved as a singleton from config, the values are baked in when config is cached, so per-request alphabets or dynamic runtime changes will not work as expected, especially under Octane. Decide the values once and keep them consistent across all environments.
- Is there a Laravel validation rule for Sqids?
- The package ships a validation rule so you can verify that an incoming value is a valid Sqid before your controller logic runs. Pair it with form requests to reject malformed identifiers with a clean 422 response. It complements, but does not replace, the existence and authorization checks you perform against the actual record.
- What happens when Sqids decode() receives an invalid ID?
- decode() returns an empty array for input that cannot be decoded, rather than throwing an exception. You must check explicitly and return a controlled 4xx response. Never pass the decoded value straight into find() or first(), because an empty result can otherwise produce confusing behavior. Centralizing that check in middleware, a form request, or a route binding callback keeps the contract consistent.
- Can I change the Sqids alphabet or min_length after launch?
- Technically yes, but doing so invalidates every identifier you have already issued, including links in emails, bookmarks, and third-party callbacks. The alphabet and minimum length are part of your public ID contract, so treat them as immutable once the feature is live. If you must rotate them, plan a migration window that still accepts the old format while generating new IDs.
- What are the alternatives to Sqids for short IDs in Laravel?
- If you need unguessable identifiers, use UUIDv7, ULIDs, or signed URLs instead, since those are not reversible by clients. Hashids is the closest conceptual alternative to Sqids, but Sqids is the more actively maintained core library. If you want to drop the wrapper entirely, sqids/sqids offers roughly the same encode and decode surface and can be bound into the container yourself.
Weaver
How can I help you explore Laravel packages today?