Is cuid still maintained?
No — cuid stopped being maintained around January 2023. @paralleldrive/cuid2 is the same idea rebuilt from scratch.
- Status
- No longer maintained
- Last maintained
- January 2023
- Use instead
@paralleldrive/cuid2— on npm- Succession
- Reimplementation
- Drop-in
- no — expect code changes
- Confidence
- high
What should I use instead of cuid?
@paralleldrive/cuid2 is the same idea rebuilt from scratch. @paralleldrive/cuid2 is not a drop-in replacement, so expect to change call sites.
How to migrate from cuid to @paralleldrive/cuid2
cuid() becomes createId() from @paralleldrive/cuid2. Cuid2 ids are deliberately not sortable, so anything that relied on cuid's rough ordering needs its own timestamp column.
Why cuid is on this list
cuid carries an npm deprecation notice from its author stating that cuid and similar k-sortable, non-cryptographic identifiers are insecure, and pointing at @paralleldrive/cuid2. Cuid2 is a ground-up rewrite by the same author built on a cryptographically secure hash. Identifiers produced by the two are not interchangeable.
The succession is settled: primary sources agree and the ecosystem has already moved.
cuid alternatives
Beyond the primary recommendation, these are credible for cuid's use case:
nanoid— view on npmuuid— view on npm
Check your own project for cuid
npx dead-deps --all --min-state unmaintainedRun that in the directory holding your lockfile. If cuid is anywhere in your tree — a direct dependency or buried under something else — it appears in the report with this verdict, this successor and the same evidence links, alongside anything else that has stopped moving. Nothing is uploaded; the scan reads your lockfile locally and queries public registry metadata.
Exit code 1 means something was flagged, which makes npx dead-deps --min-state deprecated usable as a CI gate. See how verdicts are produced.
Evidence
Every claim on this page traces to a primary source. Check them:
- npm deprecation notice on cuidnpmjs.com
- paralleldrive/cuid2 repositorygithub.com
Packages related to cuid
- shortidSuccessor named by the maintainers: nanoid · unmaintained since October 2020
- node-uuidRenamed package: uuid · unmaintained since March 2017
- angularReimplementation: @angular/core · unmaintained since January 2022
- express-graphqlReimplementation: graphql-http · unmaintained since November 2020
- node-sassReimplementation: sass · unmaintained since July 2024
See the full index of covered packages, or read the methodology for how a verdict is reached and why a quiet package is not a dead one.