- How do I install torann/hashids in a Laravel application?
- Install it with Composer by running composer require torann/hashids. Laravel's package auto-discovery registers the Torann\Hashids\HashidsServiceProvider and the Hashids facade, so no manual registration is usually needed. After that, publish the configuration file with php artisan vendor:publish and select the Hashids provider or config tag.
- How do I configure the Hashids salt, minimum length, and alphabet?
- All settings live in the published config/hashids.php file, where you can set the salt, minimum length, alphabet, and separator for each connection. The salt should come from an environment variable read only inside that config file, never via env() at runtime, because env() returns null once config is cached. The length value is a minimum, not a fixed width, so encoded strings can grow as your ID volume grows.
- How do I encode and decode an ID with the Hashids facade?
- Use Hashids::encode($id) to turn an integer into a short string and Hashids::decode($hash) to convert it back. The package also exposes encodeHex and decodeHex for hexadecimal input and connection() for named configurations. Decoding returns an array of integers, so pull the first element when you expect a single ID.
- Does torann/hashids support Laravel 11 and Laravel 12?
- It supports modern Laravel releases via the standard service provider and facade integration. Rather than trusting changelog claims, check the illuminate/support constraint in the package's composer.json against your deployed PHP version and Laravel floor. Running composer why-not torann/hashids in your app is a quick way to confirm compatibility before adopting it.
- Can I use Hashids automatically for Eloquent route keys?
- Yes, the package ships an optional model trait that hashes a model's route key so URLs expose the encoded value instead of the raw primary key. Route model binding then resolves the incoming hash back to the correct record. Keep the trait limited to public-facing routes and leave admin or service-to-service identifiers untouched.
- Is Hashids secure enough to prevent IDOR or unauthorized access?
- No. Hashids is obfuscation, not authorization: anyone with the salt can decode every value, and a leaked salt exposes your entire ID space. Keep policies, gates, and ownership checks on the server for every request, and treat Hashids purely as a way to stop broadcasting sequential counts and growth rates. If you need true unguessability, use ULIDs, UUIDv7, or opaque random tokens stored server-side instead.
- How do I use multiple Hashids connections in one application?
- Define each connection as a named array in config/hashids.php with its own salt, length, and alphabet. Then call Hashids::connection('name')->encode($id) to target a specific one. This is useful when, for example, public marketing links and partner API identifiers should not be mutually decodable.
- Why does Hashids decode() return an empty array instead of null?
- An empty array is the library's signal that the input could not be decoded, typically because the string was truncated, tampered with, or produced with a different salt or alphabet. Because it is not null, naive code that dereferences the result can throw or return 500 errors. Wrap the call in a small adapter that returns ?int and validate the shape in a form request so bad hashes produce a clean 422 or 404 response.
- What happens to existing URLs if I rotate the Hashids salt?
- Every previously generated hash becomes undecodable at once, so all outstanding links and stored hashes break simultaneously. Before adopting the package, write down a rotation policy with an owner, a dual-read window, redirect handling for legacy URLs, and a communication plan. Because the salt is sensitive, store it in a secret manager, keep it out of logs and stack traces, and never commit it to the repository.
- What are the alternatives to torann/hashids for hiding database IDs?
- Use ULIDs or UUIDv7 when you need unguessable identifiers that still sort by creation time. Use random opaque tokens persisted in a column or cache when the identifier must be truly secret or revocable. Use signed URLs when you only need to prove a link was issued by your application. Hashids remains a good fit when the goal is purely cosmetic obfuscation of sequential integers with no schema change and a cheap revert.