UUID Generator

What a UUID is for

A universally unique identifier is 128 bits, written as 32 hexadecimal digits in five hyphenated groups. Its purpose is letting independent systems mint identifiers that will not collide without coordinating with each other, which is what makes distributed systems, offline clients and database sharding practical.

Version 4 and why collisions are not a concern

Version 4 is 122 random bits, with six bits fixed for version and variant. The collision probability is negligible in a way that is hard to convey: you would need to generate roughly 2.7 quintillion UUIDs before reaching a one-in-a-billion chance of a single duplicate. In practice, v4 collisions come from a broken random source, never from exhausting the space. That is why generating them with a cryptographic random source rather than a pseudo-random one matters.

Version 7 solves the database problem

Random v4 identifiers are poor primary keys at scale. Because they sort randomly, each insert lands in an arbitrary position in a B-tree index, fragmenting it and destroying cache locality. On large tables this measurably degrades insert throughput. Version 7 puts a millisecond timestamp in the leading bits, so identifiers sort roughly in creation order, inserts append to the end of the index, and the problem disappears. Where you control the schema and want UUID keys, v7 is now the sensible default.

Version 1 leaks information

Version 1 combines a timestamp with the machine's MAC address. That makes it sortable but means every identifier discloses when it was created and which machine created it. It has been used to attribute anonymous documents to specific hardware. Avoid it unless you specifically need those properties and accept the disclosure.

UUIDs are not secrets

A v4 UUID is unguessable, which tempts people to use one as a capability token in a URL. That works only while the URL stays private, and URLs leak: through referrer headers, browser history, server logs, chat previews and shoulder-surfing. Use a UUID as an identifier and a real access control for authorisation.

Generated locally

Values come from the browser's Web Crypto API and are never transmitted.