Hi, looks like it was a fun project. While you save yourself from checking the DB for a duplicate hash with your hex id strategy, a side effect of this technique is that every URL created with your service is effectively public. For instance, I could start at <a href="http://briancray.com/tests/shorturl/0" rel="nofollow">http://briancray.com/tests/shorturl/0</a> and work my way up through every URL ever shortened by incrementing the id in hex. Whether this is a vulnerability or undocumented feature is up to you to decide :)<p>I bring it up because I ran across the same issue with my own site, droplink.me. It was a more serious problem for me, because user uploaded files are supposed to be private. I went with randomly generated URLs.