v4 and v7, and when each is right
v4 is 122 bits of randomness. Nothing about it is predictable or derivable, which is exactly what you want for a share link, a password reset token, or any identifier that must not be guessable from another one.
v7 puts a millisecond timestamp in the first 48 bits, a counter in the next 12, and randomness in the rest. Two consequences follow. Ids sort by creation time as plain text, and each new id is larger than the last, including inside the same millisecond.
That counter is the part most generators skip. Without it, a thousand ids created in the same millisecond are random among themselves and a bulk batch does not sort, which removes the only reason to choose v7. This one fills it, so a generated list is ordered as written, up to 4096 per millisecond.
That second property is the reason v7 exists. A database index on a random primary key gets written all over, because every insert lands in a different place. With a time-ordered key, inserts land at the end, the index stays compact, and the cache behaves. On a large table the difference is measurable.
The cost is that a v7 id tells anyone holding it roughly when the row was created.
Formats
| Format | Looks like |
|---|---|
| lowercase | f47ac10b-58cc-4372-a567-0e02b2c3d479 |
| UPPERCASE | F47AC10B-58CC-4372-A567-0E02B2C3D479 |
| braces | {f47ac10b-…} |
| no dashes | f47ac10b58cc4372a5670e02b2c3d479 |
The canonical form is lowercase with dashes. Braces come from the Windows world, and the undashed form is common as a compact database or URL identifier. They are the same 128 bits either way.
Not a password, not a secret by default
A v4 UUID has enough entropy to be unguessable, which tempts people to use one as a session token or an API key. That works only while it is treated like a secret: not in a URL, not in logs, and revocable.
A v7 UUID should never be used that way. Half of it is a timestamp.
Generated here, not fetched
Some online generators call a server for the values, which means someone else has seen every id you were handed. These are produced in your browser, so the list is yours alone. You can confirm it with the network tab: nothing is requested.
Questions
Where do the random numbers come from?
From crypto.getRandomValues, the browser's cryptographically secure generator. They are produced on your device and never transmitted, so nobody else can have seen them.
v4 or v7?
v4 for anything that must be unguessable. v7 for database primary keys, because the timestamp prefix makes new rows land at the end of the index instead of scattering across it.
Are v7 UUIDs safe to expose publicly?
They reveal roughly when they were created, to the millisecond. That is usually harmless and occasionally not, for instance when it lets someone time an account creation.
Could a v4 collide?
There are 2^122 of them. You would need to generate about a billion per second for a century to have a meaningful chance of a single collision.
What is the nil UUID for?
All zeros, used as an explicit “no value” where the column cannot be null. It is a convention, not a random id.