The document, from what I could glean they were PDFs.

Edit: even if they aren't PDFs, you can feed the content to the hash function.

I suppose that might work but seems needlessly complex compared to just a long securely generated random number.

Yeah, randomly generated IDs are fine for most use cases IMO, and perhaps more importantly they’re easy to implement well enough—grabbing 256 bits from /dev/urandom isn’t bad.

With a hash it’s more expensive to compute the ID, but you get advantages such as content-addressability, data integrity without trust, and easily mergeable databases. It’s a good amount of bang for not much more buck.

At the cost of leaking more metadata in the ID, by including a checksum/namespace, you can recognise a valid ID or determine the type of object it refers to without fetching anything from storage, mitigating some DOS attacks.

IDs are a subtle thing, and in my experience, often overlooked as a design issue. A lot of times it ends up as something like “id integer primary key autoincrement” without any thought.