OK - so first it sounds odd that you are encoding a "user_id" (which sounds to me like a username) which I would think of as a relatively public peice of information - and not a password or something similarly secret - but the question is really about encryption, so I digress...
"Strong enough" for any encryption algorithm is rated by how long will it take to decrypt the text without having the key (presuming that you've hidden away your secret key in a good way). No algorithm is "perfect" except the classic One Time Password - which is a fine academic example, but not so useable in 99% of cases, as it requires the same size key space as the data encrypted, and so you will be constantly generating and storing new key - which raises its own security concerns.
So.. any realistic algorithm is considered "strong enough" if it will take longer to decrypt the material w/out the key than the information is worth. So - if the information is my lunch plans for tomorrow, it's likely that my encryption algorithm may only need to delay an attacker 24 hours by which time, the event will be over, and it wouldn't matter cause you can't find me there anymore... but it may matter for years, if my lunch was some historic event or something.
So the factors of encryption cracking calculation include:
- what are the weaknesses of the algorithm - some algorithms can have weak key sets that are eaiser to decrypt, others can get proved to add little value (some forms of DES)
what is the size of the key space - if all keys are equally secure, then the obvious way to crack the algorithm is to try every possible key of the given size - how many keys is a factor of storage size and the nature of how keys are chosen (for example, prime numbers are used in assymetric encryption)
how hard is testing a decryption - how long will it take to try a test with a given key choice?
So... in a simple algorithm, time to crack can be:
# of keys in key space X time to test a key
That is usually factored over how many resources can you reasonably expect a hacker to have? A small organization may have 10-50 machines. A nation state may have millions. What is the nature of the threat - how much computational power can they resonably have? You don't necessarily assume its limited by thier purchasing power at Best Buy - if they are technically sophistcated, they have a massively parellel botnet of malicious software on innocent user machines doing their computation.