there's a bunch of ways. pg_hashids would be perfect.. if it weren't for the very dire warnings against expecting it to make "hard to guess" URLs, since it's cryptographically broke