unique database urlkey instead of id

Question

I have a web application where users can login and read their messages. I use to use the ID primary key in database to access and deal with users message through the site such as (viewmessage/3) but I quickly realised I did not want to do that as it gave information to all users as to how many potential messages are stored in database. Same idea with the users, to view a users profile I use to use their ID but that gives out how many users on the site... So what I did is added a new column in each table called UrlKey, this key is a varchar(16) which is composed of 16 unique randomly generated numbers which I use to map to ID on the server side.

My question now, is 16 too much or common practice (16^10), should I use just ints or a mix of int and ascii characters, any guidelines recommendations in terms of speed, security etc...? Thanks alot

Answer 1

16^10 is a huge number, that is over 1 trillion messages.

If you use mixed case letters and numbers, that gives you 62 characters to work with, and with 5 characters you already have 62^5 combinations, it's almost 1 billion combinations.

Answer 2

Most database use a GUID or the UUID for a unique string instead of an auto incremented id. They both can be stored as a 16 bytes 128 integer but is 32 characters.

I would use a GUID or a UUID. Then you are always going to be unique.