Show HN: Arxid – keyed, non-enumerable ID obfuscation

I kept reaching for Hashids/Sqids to keep sequential IDs out of URLs, but they don't use a real key — the alphabet is shuffled by a salt, and the Sqids FAQ says outright "there is no encryption of any kind."

arxid is a keyed reversible permutation instead: a balanced Feistel network with an ARX (add-rotate-xor) round function over a 40-bit domain, mapping to a 7-char base62 code. Feed it an integer, get an unpredictable code back; same key reverses it. Runs ~16x faster than a structurally identical Feistel using HMAC-SHA256, because the round function is integer ops instead of a hash call.

The round count (4) isn't a guess — it's calibrated by measuring strict avalanche. I'm also upfront in the README about what it is NOT: not encryption, not a MAC, not audited. It's a speed bump against enumeration, not access control.

The part I care most about is portability: a frozen spec + canonical test vectors act as the contract, so any port in any language validates against the same vectors and is interoperable by construction. Rust reference + TypeScript port so far.

Happy to answer questions on the construction, the calibration, or the cross-language design.