Which along with other block ciphers are the surprisingly hard to search solution to the problem of providing a bounded, iterable, id that doesnt leak its position of iteration.

(ie, provide an n character id without duplicates and using the entire space. Useful for ids for image hosting etc.)

Or just CTR mode of a hash function (which is closer to what ChaCha20 does internally, it runs a permutation in CTR mode). H(constant, key, nonce, ctr) gets a keystream block, XOR each keystream block with the corresponding plaintext (to encrypt) or ciphertext (to decrypt) block. The constant is important in ChaCha's case, it keeps the attacker-controlled portion of the block strictly less than half the total block, prevents an all-zero input, and has some asymmetry to help diffusion overall.