IDs-LE

IDs-LE: The ID That Only Looks Like One

Find every identifier in a document, decode the time inside it, and refuse the ones that cannot be named

UUID · ULID · NanoID · MongoDB ObjectId · Snowflake

---

Useful? A star or rating is how other developers find it —

★ GitHub ·

★ Open VSX ·

★ Marketplace

What it does

A support ticket quotes 6a7bb780a1b2c3d4e5f60718 and asks when the record was made. A regex says ObjectId, minted 2026-08-12. It is the front of a git commit hash, and the date is noise that happens to land in a plausible year.

Open a document, run IDs-LE: Extract IDs, and every identifier in it is listed by kind with its line and column, the document's own key path for it, whether it is valid, and — for the six schemes that carry a clock — the instant it was minted, as ISO-8601 UTC. The report opens beside the editor. IDs-LE: Scan Workspace for IDs does the same for every file in a project, and IDs-LE: Scan Folder for IDs for one folder. Works in VS Code and in VS Code–based editors like Cursor and VSCodium (installable from Open VSX).

• Reading a log or a dump — which of these are UUID v7s, and when was each minted?
• Reviewing a config — the placeholder nil UUID that escaped into production
• Before trusting a hex string — whether the document actually says it is an identifier
• Across a project — every file that holds an identifier, and how many, in one table

A run it cannot name honestly is reported with the reason, never dropped. It rewrites nothing.

Install

It refuses rather than guesses

A tool that answers confidently and wrongly is worse than one that stops and names what it needs. So every run this crate will not name is a row in the report with a reason — never a dropped row, never a silent guess.

Some are worth spelling out, because they are the cases a regex gets confidently wrong:

• 5d41402abc4b2a76b9719d911017c592 is an unhyphenated UUID and an MD5 digest. Nothing in a document separates them, so nothing here picks.
• 6a7bb780a1b2c3d4e5f60718 is 24 hex characters. Under _id it is an ObjectId minted on 2026-08-12. Under checksum, or in prose, it is refused — an ObjectId's whole specification is *24 hex characters*, so a truncated SHA-1 fits it exactly and only the document can tell them apart.
• 1536886938009600000 under channel_id is a Discord Snowflake at 2026-08-12. Under a bare user_id it is refused, because the Twitter epoch fits too and the document does not say which. Under population it is not a finding at all.

The full table, and the boundaries the tool holds itself to, are in crate/SPEC.md.

The kinds

Two of those kinds need the document's permission. An ObjectId is 24 hex characters and a Snowflake is a large integer; neither carries a version, a variant, a checksum or a restricted alphabet, so neither run can say on its own what it is — a truncated git hash is a structurally perfect ObjectId, and a byte count is a structurally perfect Snowflake. Both are named only where the field's own name ends in id (_id, userId, USER-ID, $oid), and refused as ambiguous_kind otherwise. In a plain-text file, which has no keys at all, neither is ever named.

All eight UUID versions RFC 9562 defines are recognised, and all four variants — ncs, rfc4122, microsoft, future — are reported. A version is only reported under the RFC variant, because in any other layout those four bits are not a version field.

The timestamps

This is the part nobody wants to write twice. Six of these carry a clock, in six unrelated bit layouts, over four different epochs — one of which starts in 1582:

Every one comes back as the same ISO-8601 UTC string, milliseconds always present. UUID v2 is named and not decoded: its clock has its low 32 bits overwritten by a POSIX uid, so it resolves to roughly seven minutes and is not the same claim.

A decode that lands before 1990 or more than a year from now is refused as timestamp_implausible — and the decode is on the row next to the flag, because a refusal that hides its evidence is a verdict a reader cannot check.

Formats

JSON (and JSONC), YAML, TOML, INI (.properties), dotenv, CSV and TSV give each finding a key path — service.requestId, documents.[0]._id, discord.channel_id. Everything else is read as text: the same runs, in the same places, without the key.

The key path is evidence, not decoration. ObjectId and Snowflake are named only under a field the document calls an id, so a run that is named in the .json comes back ambiguous_kind in the .md beside it — same row, same position, same decode, and a reason instead of a name.

Across a folder or a workspace

Extract reads the document you have open. A scan reads many files from disk and gives one report.

• The whole workspace: run IDs-LE: Scan Workspace for IDs from the command palette.
• One folder: right-click it in the Explorer and choose Scan Folder for IDs, or run IDs-LE: Scan Folder for IDs and pick one.

The report opens with a table of every file that holds something, then has a section per file:

# IDs-LE workspace report

my-project · 113 file(s) read · 2 named, 3 could not be named

lib/transcripts.ts · text (2)

• 55:40 · 019ff344-cc00-7abc-8def-0123456789ab · uuid · v7 · 2026-08-12T00:00:00.000Z
• 56:24 · 01KZSM9K00ABCDEFGH12345678 · ulid · 2026-08-12T00:00:00.000Z

2 file(s) larger than the safety limit were not read.

What a scan reads. Files come from disk, so an unsaved edit is not seen. A file over the safety size, or one that is not UTF-8 text, is left unread. It stops at 5,000 files or 10,000 listed identifiers. The report ends with a line for each thing it left out, so a short report is never mistaken for a clean project.

What it skips, and how to change that. Three switches are on by default, and each can be turned off on its own in Settings:

Two lists adjust the result without turning a switch off. To skip more, add a pattern to scanExcludes. To read something a switch would skip, add it to scanAlwaysInclude:

{

// Also skip the test fixtures. "ids-le.workspace.scanExcludes": ["/fixtures/"], // Read the vendored code, though the built-in list skips it. "ids-le.workspace.scanAlwaysInclude": ["/vendor/"] }

IDs-LE: Open Settings opens all of these in the Settings editor.

The built-in list

Folders, wherever they appear:

.git, .hg, .svn, node_modules, bower_components, jspm_packages, .pnpm-store, .yarn, vendor, site-packages, Pods, Carthage, dist, build, out, target, _build, _site, dist-newstyle, zig-out, storybook-static, cdk.out, DerivedData, CMakeFiles, .next, .nuxt, .output, .svelte-kit, .angular, .astro, .docusaurus, .vuepress, .expo, .turbo, .parcel-cache, .cache, .sass-cache, .jekyll-cache, .dart_tool, .pub-cache, .gradle, .kotlin, .cxx, .externalNativeBuild, captures, ephemeral, .symlinks, .swiftpm, .build, .bundle, .stack-work, .zig-cache, .godot, elm-stuff, .vercel, .netlify, .serverless, .aws-sam, .terraform, .venv, venv, __pycache__, .tox, .nox, .mypy_cache, .pytest_cache, .ruff_cache, .ipynb_checkpoints, .eggs, coverage, htmlcov, .nyc_output, .vscode-test, .idea, .vs, xcuserdata, *.egg-info

Files, wherever they appear:

<!-- built-in-file