Drupal Commerce | Hide or set an alias to the order number in the checkout path
I to went that road, did not want customers to see an on each order incrementing ID in URL's. In hook_url_outbound_alter() any path can be encrypted by altering the regular expression.

/**
 * Implements hook_url_inbound_alter().
 */
function mymodule_url_inbound_alter(&amp;$path, $original_path, $path_language) {
  // Decrypt paths that are encrypted by our hook_url_outbound_alter() to hide possible id's in paths.
  if (preg_match('#^ENC:(.+)#', $path, $m)) {
    $path = _mymodule_mcrypt('decrypt', $m[1]);
  }
}

/**
 * Implements hook_url_outbound_alter().
 */
function mymodule_url_outbound_alter(&amp;$path, &amp;$options, $original_path) {
  // To hide id's in paths, we encrypt them.
  if (preg_match('#^checkout/.*#', $path, $m)) {
    $path = 'ENC:' . _mymodule_mcrypt('encrypt', $path);
  }
}

/**
 * Helper function to encrypt and decrypt strings, ie. paths to hide containing id's.
 * NB: We replace forward slashes for exclamation marks, otherwise trailing 
 *     slashes in the URL will be ignored by Drupal.
 */
function _mymodule_mcrypt($action, $string, $key = null) {
  if (!$key) {
    $key = $GLOBALS['drupal_hash_salt'];
  }

  $mcrypt_method = MCRYPT_RIJNDAEL_128;
  $iv_size = mcrypt_get_iv_size($mcrypt_method, MCRYPT_MODE_CBC);

  // Make key exactly as long as long as $iv_size.
  $key = substr(str_repeat($key, CEIL($iv_size / strlen($key))), 0, $iv_size);

  if ($action == 'encrypt') {
    $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
    $encrypted_string = base64_encode($iv . mcrypt_encrypt($mcrypt_method, $key, $string, MCRYPT_MODE_CBC, $iv));
    return preg_replace('#/#', '!', $encrypted_string);
  }
  elseif ($action == 'decrypt') {
    $decrypted_string = base64_decode(preg_replace('#!#', '/', $string));
    $iv = substr($decrypted_string, 0, $iv_size);
    $decrypted_string = substr($decrypted_string, $iv_size);

    return rtrim(mcrypt_decrypt($mcrypt_method, $key, $decrypted_string, MCRYPT_MODE_CBC, $iv));
  }

  return false;
}