CUID Generator
Generate collision-resistant unique IDs — sortable, URL-safe alphanumeric strings.
crypto.getRandomValues). On the random block alone, a 50% chance of any collision needs about 329,597 IDs generated in the same millisecond by the same session — the timestamp and counter rule out the rest. What is a CUID?
CUID (Collision-Resistant Unique ID) is a format designed to be safe to generate on many machines at once without coordinating. Each ID here is built from four parts, in this order: a leading prefix (so an ID never starts with a digit and is safe in an HTML id or a CSS selector), a base36 timestamp, a counter, and a block of random characters from crypto.getRandomValues.
Putting the timestamp first is what makes the IDs sortable: because base36 digits sort in the same order as their values, sorting the strings alphabetically puts them in the order they were created. The counter handles the case the timestamp cannot — a loop generating many IDs lands most of them inside the same millisecond, and the counter keeps those distinct and ordered. The random block is what makes two independent browsers unlikely to collide, and the readout above states how much of it you are getting.
Note that CUID v1 is formally deprecated by its author in favour of CUID2, which drops the timestamp and counter in favour of hashing everything together — more uniform, but no longer sortable. This tool generates the v1 shape precisely because sortability is usually why people reach for CUID over a UUID. If you do not need ordering, a UUIDv4 or NanoID is simpler; if you want ordering with a standardised layout, ULID is the closest thing.
For UUID generation, use the UUID Generator. For ULID (timestamp-sortable like CUID), try ULID Generator. For NanoID, see NanoID Generator.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Producing a collision-resistant identifier that is shorter than a UUID.
- Generating ids client-side for a distributed system without coordination.
- Producing keys that sort roughly by creation time.
- Creating identifiers for a test fixture that cannot collide.
- Generating a URL-safe id without hyphens.
Frequently Asked Questions
- What is a CUID made of?
- A prefix letter, a base-36 timestamp, a monotonic counter, a per-session fingerprint, and a random block. The timestamp makes them sort roughly by creation order; the rest makes collisions vanishingly unlikely.
- Why is the counter necessary?
- Because `Date.now()` only resolves to the millisecond, and a tight loop generates many IDs inside one. Without the counter, separating them would rely entirely on the random block; with it, the difference is structural.
- Is the fingerprint derived from my device?
- No — it is per-session randomness, minted once when the page needs it. Some implementations build it from user-agent and screen properties, which is a tracking vector this one deliberately does not use.
- How much entropy does a CUID really have?
- Only the random block counts. The timestamp and counter are predictable by design and the fingerprint is constant within a session, so quoting the whole string's length as entropy overstates it considerably.
- How does it compare to a UUID?
- CUIDs sort by time, which keeps database index inserts near the end of the B-tree instead of scattered — the same reasoning behind UUIDv7. A random UUIDv4 has more entropy but fragments indexes.
- Are CUIDs safe to expose publicly?
- The original CUID spec was retired partly because its structure leaks creation time and hints at volume. For a public identifier where that matters, a random UUIDv4 or a longer random string is the safer choice.
Common errors and gotchas
- Assuming the id is unguessable, when earlier versions were explicitly not designed for that.
- Mixing CUID versions across a system, where the format and guarantees differ.
- Relying on strict sort ordering, which is approximate rather than guaranteed.
- Treating the embedded counter or fingerprint as private, since it can leak host information.
- Using it where a cryptographically random id was actually required.