Everything will be stored on the server, I only need to identify the visitor each time. So I only need to have a ID in the cookie, but that is not safe because, of the cookie manipulation. So I can encode it, but base64 is also not a good idea because still everyone can encode/decode it and manipulate the cookie.

I also can generate a unique string in the database and use that as an cookievalue.
But why not generating a unique string with the ID or something else, so I can decode it back to the ID. But what is a good method? Maybe blowfish?