Question

Are they somewhat random?

I mean….would people be able to break them apart?

Answer 1

Generation

They are usually generated on the client side by the driver itself. For example, in ruby, BSON::ObjectID can be used:

• https://github.com/mongodb/bson-ruby/blob/master/lib/bson/object_id.rb#L369

You can also generate your own ObjectIds. This is particularly useful if you want to use business identifiers.

Breakability

• When using driver generated ObjectIds, is low
• When using own business Id, is slightly higher depending on their predictability (login, consecutives identifiers…)