CUID2 Generator

CUID2 (Collision-resistant Unique IDentifier, v2) is a modern ID format designed by Eric Elliott as a safer, more collision-resistant alternative to UUIDs and the original CUID. This tool generates real CUID2-style identifiers directly in your browser: lowercase letters and digits only, always starting with a letter, with a length and batch size you control.

What CUID2 looks like

A CUID2 is a lowercase alphanumeric string, for example tz4a98xxat96iws9zmbrgj3a. Unlike UUIDs, it never contains hyphens or uppercase characters, and unlike auto-incrementing integers, it carries no information about how many records exist or in what order they were created. Every ID is guaranteed to start with a letter (never a digit), which keeps it safe to use as a variable name, a CSS class, or an identifier in systems that don't allow identifiers to start with a number.

How it's generated

Each ID combines several sources of entropy — a millisecond timestamp, a monotonic counter (so IDs generated in the same millisecond don't collide), a random salt, and a session fingerprint — concatenated and hashed with SHA3-512. The digest is converted to base36 (digits 0-9 and lowercase letters a-z), a random starting letter is prepended, and the result is truncated or padded to the requested length. This mirrors the real algorithm behind the CUID2 reference implementation: hashing the entropy sources together (rather than exposing them directly, as the original CUID v1 did) means an ID reveals nothing about when or in what order it was created.

How to use this tool

1. Set the ID length — anywhere from 4 to 32 characters. The default, 24, is what the reference CUID2 library itself recommends for most applications.
2. Set how many IDs to generate at once (1 to 50).
3. Click Generate. Each line of the output is one independent CUID2.

Copy the whole list, or download it as a .txt file, one ID per line.

What CUID2s are used for

• Database primary keys — collision-resistant, non-sequential IDs that don't leak row counts or insertion order (a common concern with auto-incrementing integers in public APIs).
• Distributed ID generation — because each ID is derived locally from a timestamp, counter, and random entropy, independent services or offline clients can mint IDs without coordinating with a central authority or database sequence.
• An alternative to UUID — CUID2s are shorter than a standard UUID (36 characters with hyphens), URL-safe with no escaping needed, and — because they always start with a letter — safer to drop into contexts (HTML IDs, code identifiers, some legacy database columns) that reject a leading digit.
• Test and demo data — quick, realistic-looking unique identifiers for seeding fixtures, mocking API responses, or wiring up UI prototypes before a real ID scheme exists.

FAQ

Is a CUID2 cryptographically secure? No, and it isn't meant to be. CUID2 is designed for collision resistance — the practical guarantee that two independently generated IDs won't clash — not for unpredictability against an attacker. Don't use a CUID2 as a password, API secret, or session token.

Can I sort records by their CUID2? Not reliably. Unlike the original CUID (which exposed the timestamp in plain text, making IDs roughly sortable by creation time), CUID2 hashes the timestamp together with other entropy before emitting the ID, so the output isn't chronologically ordered. If you need sortable IDs, look at ULID or a timestamp-prefixed scheme instead.

Why does every ID start with a letter? So the ID is always safe to use as an identifier in more contexts — CSS classes, JavaScript variable names, and some database or query-language identifiers can't begin with a digit. CUID2 guarantees this by always prepending a random letter before the hashed portion.

What length should I pick? The reference implementation defaults to 24 characters, which offers a very large ID space for typical application use. Shorter lengths (8-10) are fine for short URLs or low-volume use cases where a smaller footprint matters more than maximum collision resistance; longer lengths (28-32) suit very high-volume, high-concurrency systems.

Privacy

Every ID is generated locally in your browser using standard SHA3-512 hashing — nothing you generate here is sent to a server, logged, or stored.