Question

I want to allow users to validate their email address by clicking on a link. The link would look something like

http://www.example.com/verifyemail?id=some-random-string

When I am sending this email, I want to be able to easily generate this ‘some-random-string’ from row id of user, an integer. and when user clicks on this link, generate that integer back.

Only requirement is this ‘some-random-string’ should be as opaque and non-guessable to the user as possible.

---

Finally, this is what I settled on

def p3_encrypt_safe(plain, key):     return base64.urlsafe_b64encode(p3_encrypt(plain, key)) 

used the nice crypto library from http://www.nightsong.com/phr/crypto/p3.py addition of base64 safe encoding is mine.

Answer 1

Use encryption, that’s exactly what it’s designed for. Blowfish, AES, even DES3 if you don’t need particularly high security.

Alternatively, you could compute an SHA-256 or SHA-512 (or whatever) hash of the email address and store it in a database along with the email address itself. That way you can just look up the email address using the hash as a key.