They're mostly from the EPSG - https://www.epsg-registry.org/
To be unique, you have to specify where they are from (basically a namespace - EPSG:4326, not just 4326). However most people will interpret them as EPSG if not specified.
Originally, the EPSG registry was maintained in a Microsoft Access database and the well-known IDs (WKIDs) were assigned by hand. Thus you can see ranges like the WGS 84 UTM zones: 326 + zone number for the North zones, and 327 + zone number for the South zones. "326" is from WGS 84, "4326". There are similar sets for NAD83, NAD27, ED50. If new zones were added, they usually received noncontiguous WKIDs.
When the registry migrated to a DBMS, the WKID assignments became random. It was not planned that the original "web Mercator" WKID was 3785 and its replacement was 3857.
There are other namespaces - spatialreference.org provides ESRI codes, IAU2000 codes for other astronomical bodies and several thousand of its own, many of which are junk or user tests. spatialreference.org does not have every namespace though - spatialite supports some extra codes, including those defined by gfoss.it; and NGA has some codes defined too - see NGA.STND.0051_2.0_GEOPKG for their GeoPackage related codes.
EPSG codes are unique within a range of 1024 to 32766 inclusive. Codes for proprietary data range from 50000 and up, inclusive. There are several thousand codes defined and published by the EPSG - you can download the full set from http://www.epsg.org/.
So 900913 isn't an official code from EPSG - its from that proprietary range. The specific number is just
google as numbers (g => 9, o => 0, and so on).
Also, 3857 isn't really Mercator, but rather a spherical approximation (sometimes "web-Mercator").