Overview of globally unique identifiers

Security

There are two main aspects I found for judging ID security:

• How easy is it to predict other ids
• How much information is leaked by the id

Monotonically Increasing

A monotonically increasing ID is one where IDs can be strictly orderd by the order they were created.

For instance, the following IDs are monotonically increasing:

1 2 3 4 5 6

So are the following IDs:

1234-abcd 1234-abce 1235-aaaa 1235-aaab

All the above IDs can be sorted to get the same creation order. There are a lot of great benefits to monotonically increasing IDs. They allow programs to reason about the order of events, so a program can know if event 1 or event 2 happened first. For event queues and logs, this is great. They also provide a useful default sorting algorithm. If a user wants to see newest or oldest items first (e.g. like in a timeline), then the database only needs to sort on the ID, which is almost always indexed, even in terribly designed databases.

The downside is that these types of IDs are easy to predict. Also, they can sometimes require extra coordination and synchronization (though that is less rare these days).

Temporal

Temporal IDs are closely related to monotonically increasing IDs. The difference is that they have a timestamp embedded into them - usually in the highest digits of the ID. They aren't guaranteed to be in creation order (usually when multiple IDs are created simultaneously), but they do often require less coordination.

The biggest benefit to temporal IDs is that they allow searching and sorting based on time of creation just using the ID field. For instance, if your ID is of the format YYYYMMDD-xxxx (where `x` is random), then you can find any IDs created in December 2020 with the query:

SELECT * FROM mytable WHERE id >= '20201201-0000' AND id <= '20201231-9999'

The downside is that these IDs are also generally pretty easy to predict. They also aren't strict on preserving creation order, so there is some fuzziness there - especially as a system scales in the number of records generated. This means that temporal IDs have a looser ordering than monotonically increasing IDs. For most use cases it's fine, though sometimes it can matter.