UUID generator

All of these are generated with crypto.getRandomValues, the browser's cryptographically secure random source — not Math.random, which is predictable and unsuitable for identifiers that must not be guessable.

v4 versus v7

A v4 UUID is 122 bits of randomness. Excellent for uniqueness, terrible as a database primary key: consecutive inserts land at random positions in the B-tree index, causing page splits and poor cache locality.

v7 (standardised in RFC 9562, 2024) puts a 48-bit millisecond timestamp in the leading bits, so new IDs sort after old ones and inserts append to the end of the index. It keeps 74 bits of randomness — still far more than enough — and is the better default for new systems. The trade-off is that it leaks creation time.

Collision odds

Generating a billion v4 UUIDs a second for a century gives roughly a 50% chance of one collision. In practice, uniqueness is not the thing to worry about.

ULID and nanoid

ULID is 26 Crockford-base32 characters, lexicographically sortable by time, with no ambiguous characters (no I, L, O or U). nanoid is 21 URL-safe characters with collision resistance comparable to a UUID in 40% less space — useful for short public URLs.

Do not use UUIDs as secrets

A v4 UUID is unguessable, but a v1 or v7 one is not — the timestamp is right there in the value. For session tokens, API keys and password-reset links, use the secure token option, which is 256 bits from the CSPRNG with no structure at all.