Everything you need to know about UUIDs: what they are, the difference between v1, v4, and v5, how to generate them securely in the browser, and when to use them over other identifier schemes.
A UUID (Universally Unique Identifier), also called a GUID (Globally Unique Identifier), is a 128-bit number formatted as 32 hexadecimal characters in the pattern xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. For example: 550e8400-e29b-41d4-a716-446655440000.
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
550e8400-e29b-41d4-a716-446655440000
UUIDs are designed to be unique across all systems and all time without requiring a central coordinator to assign them. This makes them ideal for distributed systems, database primary keys, session tokens, file names, and any situation where multiple systems need to create unique identifiers independently.
UUID v1 encodes the current timestamp (at 100-nanosecond resolution since 1582) and the MAC address of the generating machine. While guaranteed unique (given accurate clocks), v1 UUIDs expose when and where they were generated — a privacy and security concern in many applications.
UUID v4 generates 122 bits of cryptographic randomness. The remaining 6 bits are fixed version and variant markers. With 2^122 possible values (~5.3 × 10^36), collisions are statistically impossible for any real-world use case. This is the version you should use for most applications.
UUID v5 generates a deterministic UUID from a namespace and a name using SHA-1 hashing. Given the same inputs, it always produces the same UUID — useful for creating stable identifiers for known resources without storing a mapping table.
The newer UUID v7 standard (RFC 9562) combines a millisecond-precision Unix timestamp prefix with random bits, making UUIDs both unique and naturally sortable by creation time — ideal for database primary keys where index fragmentation is a concern.
Modern browsers support crypto.randomUUID() natively (Chrome 92+, Firefox 95+, Safari 15.4+). This generates a cryptographically secure UUID v4 with a single function call:
crypto.randomUUID()
For environments without crypto.randomUUID(), you can construct a v4 UUID manually using crypto.getRandomValues(), setting bits 12–15 of the third group to 0100 (version 4) and bits 6–7 of the fourth group to 10 (variant 1).
crypto.getRandomValues()
Need random identifiers that are not strictly UUIDs? The SHA Hash Generator can produce 256-bit or 512-bit hex identifiers, and the Base64 Encoder can encode random binary data into URL-safe strings.