diff --git a/id.go b/id.go
new file mode 100644
index 0000000..7841a8b
--- /dev/null
+++ b/id.go
@@ -0,0 +1,14 @@
+package main
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+)
+
+// NewID — production ID generator. 8 bytes crypto/rand -> 16 hex chars.
+// Cheap and unique enough. In tests, replace via StoreOptions.NewID for determinism.
+func NewID() string {
+	b := make([]byte, 8)
+	_, _ = rand.Read(b)
+	return hex.EncodeToString(b)
+}