Encrypt them on the backend before exposing them to the public. Decrypt in the backed on access. See https://hashids.org/