📋 In This Guide
What UUIDs Are Used For
A UUID (Universally Unique Identifier) is a 128-bit value used to identify something — a database row, an API request, a session, a file — without needing a central authority to hand out sequential numbers. Because they can be generated independently on any machine with an astronomically low chance of collision, UUIDs are the standard choice whenever you need a unique ID that doesn't leak information like a sequential integer would (which reveals how many records exist, or lets someone guess adjacent IDs).
Database Keys
Primary keys that don't reveal record count or order
API Tokens
Request IDs, correlation IDs for distributed tracing
File Naming
Collision-free unique filenames for uploads
Test Data
Seeding databases with realistic unique identifiers
UUID v4 — Random
The most commonly used UUID version. A v4 UUID is generated from 122 bits of cryptographically secure randomness (the remaining 6 bits are fixed to mark the version and variant). Every UUID you generate is completely independent of every other — there's no relationship between them, and no way to predict the next one.
crypto.getRandomValues() — the Web Crypto API's cryptographically secure random number source — rather than Math.random(), which is not suitable for anything requiring true unpredictability.UUID v3 / v5 — Namespace-Based
Unlike v4, versions 3 and 5 are deterministic: they're computed from a namespace UUID plus a name string, using MD5 (v3) or SHA-1 (v5) as the underlying hash. Feed in the same namespace and name a thousand times, and you'll get the exact same UUID every time — useful when you need a stable, unique ID for something identified by a name (like a URL or domain) without maintaining a separate lookup table.
v5 (SHA-1 based) is generally recommended over v3 (MD5 based) for new applications, since MD5 is considered cryptographically weaker — though for this non-security use case (generating a stable identifier, not protecting a secret), both remain fine in practice.
Need to hash something with MD5 or SHA-256 directly?
Generate and verify MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes.
Anatomy of a UUID
A UUID is displayed as 32 hexadecimal digits in five groups separated by hyphens: 8-4-4-4-12 characters, for example 550e8400-e29b-41d4-a716-446655440000.
| Position | What It Contains |
|---|---|
| First 3 groups (minus version digit) | Effectively random or hash-derived bits |
| First digit of 3rd group | Version number (4, 5, or 3) |
| First 1-2 bits of 4th group | Variant — almost always displays as 8, 9, a, or b |
| Last group (12 digits) | Remaining random or hash-derived bits |
How Unique Is "Unique"?
A v4 UUID has 122 bits of randomness (the other 6 bits are fixed for version/variant). To have even a 50% chance of generating two identical v4 UUIDs by pure chance, you'd need to generate roughly 2.71 quintillion UUIDs — a number so large it's not a practical concern for virtually any real-world system.
5 Common UUID Mistakes to Avoid
Frequently Asked Questions
A 128-bit value, usually displayed as 32 hex digits in five hyphen-separated groups, designed to be unique across space and time without a central coordinating authority.
v4 is randomly generated — every call produces a different value. v5 is deterministic, computed from a namespace UUID and name via SHA-1, so the same inputs always produce the same UUID. v3 works the same way using MD5.
Not mathematically guaranteed, but the collision probability is astronomically low — around 2.71 quintillion v4 UUIDs would need to be generated for a 50% chance of even one collision.
Use v3/v5 when the same input should always produce the same identifier — e.g. a consistent ID based on a URL or name without a lookup table. Use v4 for general-purpose unique identifiers.
v4 UUIDs generated with a cryptographically secure random source are generally safe for uses like session tokens, though dedicated token-generation methods are preferable for highly sensitive authentication.
RFC 4122 defines four predefined namespace UUIDs: DNS, URL, ISO OID, and X.500 distinguished names — combined with your input name to compute a v3 or v5 UUID.
No. All generation happens instantly inside your browser using the Web Crypto API. Nothing is uploaded, logged, or stored on any server.