Generating unique tracking numbers

Question

I am building a small rails app and I need a way to generate tracking numbers to give to customers to check up on their status. I want something similar to what the major shipping companies use, but not as long. Im thinking 12-16 characters long is fine, but I dont want something like 0000000001 where people can just type in incremented numbers and peep around.

What is a good way to generate unique number/letter combination tracking codes?

Answer 1

For meaningless data, hashes of the time plus a salt are always rock solid, and can't be guessed easily (forgive the Python, I've heard of this Ruby thing but never held it in my hands):

>>> hashlib.md5(str(time.time()) + "!salt!").hexdigest()
'7a8b73fa7e0dadf246612e6001ede165'

Shorten it, if you like:

>>> hashlib.md5(str(time.time()) + "!salt!").hexdigest()[:16]
'46ffb69ebc96412d'

Use an integer instead, if you like, but the length has the chance to vary with this code, unless you zero-pad:

>>> int(hashlib.md5(str(time.time()) + "!salt!").hexdigest()[:13], 16)
1346212029197308

In before "zomg md5 isn't crypto secure":

>>> int(hashlib.sha256(str(time.time()) + "!salt!").hexdigest()[:13], 16)
1948411134966366

Hell, you don't even have to use time, you can use an autoincrementing integer, as long as you salt it:

>>> int(hashlib.sha256(str(1) + "!salt!").hexdigest()[:13], 16)
1269883740611281
>>> int(hashlib.sha256(str(2) + "!salt!").hexdigest()[:13], 16)
3655373802716929

Hashes. Is there anything they can't do?