- Is pgs-soft/hashid-bundle a Laravel package?
- No. It is a Symfony bundle that wraps the hashids/hashids library and registers a Symfony service, configuration, Twig filters, and a route converter. It has no Laravel service provider, facade, or publishable config/hashid.php file, so it cannot be installed and used in Laravel as-is. For Laravel, depend on hashids/hashids directly and write a thin adapter.
- How do I install and configure Hashids in a Laravel application?
- Install the framework-agnostic library with composer require hashids/hashids, then bind it as a singleton in a service provider using config values for salt, minimum length, and alphabet. Put the salt in an environment variable or secret manager rather than committing it. Explicitly set and test the minimum length and alphabet instead of relying on implicit defaults.
- Can I use Hashids with Laravel route model binding?
- Yes, but you must implement it yourself. Override getRouteKey() on the model to return the encoded hashid and override resolveRouteBinding() to decode the parameter and query by the integer primary key. Return a 404 when decoding fails so tampered or stale hashes do not leak whether a record exists.
- Is Hashids a replacement for encryption or authorization?
- No. Hashids is reversible obfuscation, not encryption, and anyone who obtains the salt can decode or enumerate every ID. Do not treat hashids as an access-control or anti-IDOR control; authorization must still happen server-side on every request. Use them to hide sequential IDs and raise the cost of casual scraping, not to protect sensitive data.
- What happens if I rotate the Hashids salt?
- Every previously generated hashid becomes invalid, so bookmarks, emailed links, sitemaps, partner integrations, and cached pages will break. There is no built-in migration path except keeping the old salt alive during a dual-verify window while old URLs expire. Treat salt rotation as a planned URL migration, not a routine secret change.
- Does pgs-soft/hashid-bundle support Laravel 10 or Laravel 11?
- The package does not target Laravel versions at all because it is a Symfony bundle. Version compatibility for a Laravel implementation depends on hashids/hashids and your PHP version, which are framework-agnostic. Test the adapter on your target Laravel and PHP versions rather than expecting the bundle to declare support.
- What are the alternatives to Hashids for hiding IDs in Laravel URLs?
- Use UUIDs or ULIDs as primary or public keys, Laravel signed URLs via URL::signedRoute for tamper-evident links, or a maintained Laravel wrapper around hashids. The right choice depends on whether the requirement is cosmetic nicer URLs, anti-enumeration, or compliance. Hashids only legitimately serves the first two.
- Can I use this bundle's Twig filters in Laravel Blade templates?
- No. The Twig extension is Symfony-specific and will not work in Blade. In Laravel, create a helper function or Blade directive that calls your own hasher service. Keep encoding out of templates where possible and generate hashids in controllers, API resources, or model accessors.
- How should I test Hashids encoding and decoding in Laravel?
- Unit test your service for round-trip encoding and decoding with a fixed test salt, plus invalid input and wrong-salt cases. Feature test route model binding to confirm a valid hash resolves and a tampered hash returns 404. Also test the largest IDs you expect, since BIGINT values beyond 2^53 and 32-bit PHP builds are real edge cases.
- Is pgs-soft/hashid-bundle actively maintained and safe to depend on?
- It has a small footprint, around 13 stars and zero dependents, with the last release in April 2023, so it is effectively a single-maintainer project. The MIT license permits forking and vendoring, which lowers the risk if you are prepared to own a small wrapper. Assess hashids/hashids separately as the real long-term dependency, and avoid installing the Symfony bundle in a Laravel app.