TikTok User ID vs sec_uid: What's the Difference?
Published
TikTok uses two account identifiers: a numeric user ID and an encoded sec_uid string. Learn what each does, where it appears, and why mixing them fails.
A TikTok user ID is a numeric identifier for an account, while sec_uid is a longer alphanumeric string that identifies the same account in a different, encoded form. They are two distinct values, not two names for one thing. TikTok's internal endpoints expect one or the other depending on the call, and substituting one for the other makes the request fail.
Two identifiers, one account
Most platforms get by with a single numeric key per account. TikTok carries two public-facing identifiers, and the duplication is the single biggest source of confusion in this area. A great deal of material online, including some tool sites, uses "TikTok user ID" and "sec_uid" as though they were interchangeable. They are not, and conflating them produces failing requests and incorrect records.
The numeric user ID, sometimes labelled uid or id in API responses, is a decimal integer. It looks like the identifiers you would see on Facebook or Instagram: a long run of digits, nothing else. This is the account's primary numeric key.
The sec_uid is a different thing entirely. It is a long string mixing letters, digits, hyphens and underscores, typically much longer than the numeric ID and visually opaque. The "sec" prefix stands for secure: it is an encoded, non-guessable handle for the account rather than a raw sequence number. Because it is encoded rather than sequential, you cannot derive one identifier from the other by any client-side transformation.
Comparison table: TikTok user ID vs sec_uid vs username
| Property | Numeric user ID | sec_uid |
Username (@handle) |
|---|---|---|---|
| Format | Decimal digits only | Long alphanumeric string with - and _ |
Short text, user-chosen |
| Typical length | Around 18 to 19 digits on newer accounts | Substantially longer, often 50+ characters | Up to 24 characters |
| Guessable or enumerable | Sequential in nature, so enumerable in principle | No, it is encoded | Yes, it is public text |
| Changes when the user renames | No | No | Yes |
| Visible in the profile URL | No | No | Yes, as tiktok.com/@handle |
| Appears in page markup | Yes, in embedded profile data | Yes, in embedded profile data | Yes |
| Primary role | Account's numeric key | Encoded account reference used by many endpoints | Human-readable label |
Read that table once more if you take nothing else away. The two identifiers differ in format, in length, in whether they can be guessed, and in which calls accept them. An interface that labels an alphanumeric string "user ID" is mislabelling a sec_uid.
Definition: what sec_uid is
sec_uid is TikTok's secure user identifier: an encoded, opaque string that references a specific account without exposing a sequential number. It appears in the JSON data TikTok embeds in profile pages and returns from its internal endpoints, alongside the numeric user ID rather than instead of it. Functionally it serves as the account handle that many of TikTok's own request paths expect, particularly those that fetch a user's video list or follower relationships. Because it is encoded rather than incremental, a sec_uid cannot be generated, incremented, or converted back into the numeric ID by any local calculation: obtaining it requires reading it from a response that contains it. It is stable for the account, so it survives username changes in the same way the numeric ID does. Treating it as a password is wrong, because it is not secret, but treating it as a drop-in replacement for the numeric ID is equally wrong, because the two values are not accepted interchangeably.
Why mixing them up breaks API calls
Endpoints validate the shape of what they receive. Pass a 19-digit decimal number to a parameter that expects an encoded string and the server either rejects it outright or returns an empty result set, because no account matches that sec_uid. The reverse fails the same way.
The failure mode is unhelpful in a specific manner worth flagging: TikTok's responses frequently return a success status with empty data rather than a clear validation error. So the symptom is not "invalid parameter", it is "this account appears to have no videos". That misleads people into debugging the wrong thing, checking their rate limits or their headers, when the actual problem is that they supplied the wrong identifier type.
A second trap is partial success. Some requests accept a numeric ID for one field and a sec_uid for another in the same payload. Fill both with the same value and one half works while the other quietly returns nothing. If you are getting a profile back but no content, or content but no profile metadata, mismatched identifiers are the first thing to check.
Where each identifier appears
Neither value appears in the profile URL. A TikTok profile lives at tiktok.com/@username, and the handle is the only identifier in that address. This differs from Facebook, where a profile without a vanity name exposes its numeric ID in the URL directly.
Both identifiers are present in the data TikTok embeds in the profile page's HTML. A profile page carries a JSON blob describing the account, and within it the numeric ID and the sec_uid sit as separate fields. Reading them manually is possible: open the page source and search for the field names. Be aware that TikTok restructures this embedded data periodically, so the exact key path shifts between site versions, and a recipe that worked last year may not resolve today.
Video URLs contain a different identifier again. The path tiktok.com/@username/video/7123456789012345678 ends in the video ID, not a user ID. Numeric and long, it is easy to mistake for an account identifier, but it refers to a single post.
The TikTok UID finder on 2uid.net resolves a handle to the account's identifiers without manual source-reading, which is the practical route for one-off lookups.
What TikTok's official APIs use
The identifiers above come from TikTok's web and app endpoints, which are internal rather than published interfaces. TikTok's official developer platform takes a different approach, and the distinction matters if you are building something intended to last.
TikTok's documented APIs, described at the TikTok for Developers documentation, operate on an authorization model. Your application asks a user for consent through Login Kit, and in return receives an open_id scoped to your application, plus a union_id for linking that person across apps belonging to the same developer. Neither value is the numeric user ID nor the sec_uid: they are a third and fourth identifier type, issued specifically for third-party integration.
This means a build on official APIs never touches sec_uid at all. If you find yourself needing a sec_uid, you are working against internal endpoints, which carries the usual consequences: no stability guarantees, no support, and terms of service that may not permit what you are doing. For anything production-facing, Login Kit and open_id are the correct path even though they require user consent you may not want to ask for.
A practical rule for keeping them straight
The simplest discipline is to label fields by their actual name in whatever you store. A column called "tiktok_id" is ambiguous and will be filled with whichever value whoever is on duty happened to find. Columns called tiktok_numeric_uid, tiktok_sec_uid, tiktok_open_id and tiktok_handle cannot be confused, and the schema itself documents the distinction for the next person.
Store the handle too, despite its instability. It is the only value a human can verify by looking at a profile, so it is what you need when you have to check a record by eye. Just do not treat it as the key.
If you work across several platforms, the mental model differs enough that it is worth seeing them side by side: the cross-platform guide to social media user IDs covers all five major networks, and the explainer on Facebook UIDs is a useful contrast because Facebook's single app-scoped number is a much simpler arrangement than TikTok's. For Instagram, where the numeric ID is sometimes called the PK, see the guide to finding an Instagram user ID.
Frequently asked questions
Is sec_uid the same as a TikTok user ID?
No. They are two separate identifiers for the same account. The user ID is purely numeric; the sec_uid is a long encoded alphanumeric string. Different endpoints accept different ones, and neither can be computed from the other.
Can I convert a numeric TikTok ID into a sec_uid?
Not by calculation. The sec_uid is encoded rather than derived, so there is no formula or local transformation. The only way to obtain it is to read it from a response that already contains it, which usually means fetching the profile.
Does the sec_uid change if someone changes their username?
No. Both the sec_uid and the numeric user ID are stable across username changes. Only the @handle changes, which is precisely why the numeric identifiers are the better thing to store.
Is sec_uid private or sensitive?
It is not secret: it appears in publicly served profile data. It is also not a credential and grants no access on its own. The "secure" in the name refers to it being non-enumerable rather than confidential.
What is open_id and how does it differ?
The open_id is the identifier TikTok's official developer APIs issue after a user authorizes your app. It is scoped to your application, so it differs from the numeric user ID and the sec_uid, both of which come from internal endpoints rather than the documented platform.
Is the long number in a TikTok video URL the user ID?
No, that is the video ID. It identifies one post. The account in that URL is identified only by the @handle that precedes /video/.
How do I find a TikTok account's IDs quickly?
Paste the profile URL or handle into the 2uid.net TikTok UID finder. Manual extraction from page source also works but is brittle, because TikTok changes the structure of its embedded profile data from time to time.
