diff --git a/src/fastapi_oidc_op/userid.py b/src/fastapi_oidc_op/userid.py
new file mode 100644
index 0000000..6f5b871
--- /dev/null
+++ b/src/fastapi_oidc_op/userid.py
@@ -0,0 +1,11 @@
+import secrets
+
+from proquint import uint2quint
+
+
+def generate_userid() -> str:
+    """Generate a unique user identifier in proquint format.
+
+    Returns a 32-bit proquint string like 'lusab-bansen'.
+    """
+    return uint2quint(secrets.randbits(32))
diff --git a/tests/test_userid.py b/tests/test_userid.py
new file mode 100644
index 0000000..f46aaa8
--- /dev/null
+++ b/tests/test_userid.py
@@ -0,0 +1,20 @@
+from fastapi_oidc_op.userid import generate_userid
+
+
+def test_generate_userid_format() -> None:
+    userid = generate_userid()
+    # 32-bit proquint format: xxxxx-xxxxx
+    parts = userid.split("-")
+    assert len(parts) == 2
+    for part in parts:
+        assert len(part) == 5
+
+
+def test_generate_userid_uniqueness() -> None:
+    ids = {generate_userid() for _ in range(100)}
+    assert len(ids) == 100  # All unique
+
+
+def test_generate_userid_is_lowercase() -> None:
+    userid = generate_userid()
+    assert userid == userid.lower()