If your API exposes /users/1042 , someone can request /users/1043 . And /users/1044 . Sequential integer IDs leak two things you probably didn't mean to leak: roughly how many records you have, and a trivial way to walk through all of them. arxid fixes that. Feed it an integer, get back an unpredictable-looking code; feed the code back with the same key, get the integer. Keyed, reversible, and byte-for-byte identical across every language it's ported to. // Rust let a = ...