One reason I started using UUIDs for database IDs is in case I make an utterly incompetent mistake and leave a URL-hacking security hole somewhere, you still would need to guess a ridiculous ID to get at anything useful.<p>EDIT: I realize UUIDs are not &quot;secure random&quot; tokens and this isn&#x27;t sufficient for real security, it&#x27;s just a nice to have encumbrance if I screw up something I should&#x27;ve made secure in the first place.  It&#x27;s no substitute for doing your job right in the first place. :)