snowflake

package
v0.783.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 29, 2026 License: AGPL-3.0 Imports: 4 Imported by: 0

Documentation

Overview

Package snowflake decodes a Snowflake ID — the 64-bit identifier used by Discord, Twitter/X, Instagram and others — into its embedded creation timestamp. A Snowflake packs a 41-bit millisecond timestamp (counted from a platform-specific epoch) in its high bits, then machine/worker and sequence bits. Decoding a Snowflake is a standard OSINT technique: a Discord user, message, channel or guild ID, or a tweet/X-post ID, reveals exactly **when the object was created** (account age, message timing, enumeration). This is the integer/social-media counterpart to the string identifier decoders (internal/uuidinfo, internal/objectid, internal/ulid). Pure offline transform; no network or device.

Wrap-vs-native judgement

Native. A Snowflake is `timestamp_ms = (id >> 22) + epoch`, then a handful of low-bit fields — a shift, an add, and some masks. There is nothing to wrap. Consistent with the other in-tree identifier decoders.

Verifiable / no confidently-wrong output

A bare Snowflake does NOT identify its platform, and the same integer yields a different timestamp under each platform's epoch. To avoid a confidently-wrong single answer, the decoder reports a labelled candidate per known platform (Discord and Twitter/X — which share the 41-bit-timestamp / 22-bit-tail layout, differing only in epoch and the machine-bit split) and asserts none; the operator selects by where the ID was found. Anchored to Discord's own documented example: 175928847299117063 → 2016-04-30T11:18:25.796Z (worker 1, process 0, increment 7). Instagram and other variants use a different bit layout and are deliberately not decoded (a wrong field split would be confidently-wrong). A non-numeric / out-of-range-uint64 input is rejected.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Candidate

type Candidate struct {
	Platform     string `json:"platform"`
	EpochMs      int64  `json:"epoch_ms"`
	TimestampUTC string `json:"timestamp_utc"`
	UnixMillis   int64  `json:"unix_millis"`
	// Discord splits the 10 middle bits into worker (5) + process (5); Twitter/X
	// uses all 10 as a single machine id. Only the relevant fields are set.
	WorkerID  *int `json:"worker_id,omitempty"`
	ProcessID *int `json:"process_id,omitempty"`
	MachineID *int `json:"machine_id,omitempty"`
	Sequence  int  `json:"sequence"`
}

Candidate is the decoding of a Snowflake under one platform's epoch + layout.

type Result

type Result struct {
	Snowflake     string      `json:"snowflake"`
	TimestampBits uint64      `json:"timestamp_bits"` // id >> 22, before adding any epoch
	Candidates    []Candidate `json:"candidates"`
	Note          string      `json:"note,omitempty"`
}

Result is the decoded view of a Snowflake ID.

func Decode

func Decode(id, platform string) (*Result, error)

Decode parses a decimal Snowflake ID. If platform is "" it returns candidates for all known platforms; a specific platform ("discord" / "twitter" / "x") returns just that one.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL