Last updated 3 September 2026
What makes a UUID "unique"
A version-4 UUID packs 122 random bits into a 128-bit value. The odds of generating the same one twice are so small that it's treated as effectively impossible in practice — you'd need to generate billions per second for billions of years before a collision became likely. That's why UUIDs are the standard choice for database keys, session tokens and anything else that needs an identifier no other system will accidentally produce.
Which version to pick
Version 4 is random. All 122 usable bits come from a random source, which makes two generated values colliding effectively impossible and makes the value reveal nothing about when or where it was made. It is the right default for anything you are not sorting.
Version 7 puts a millisecond timestamp in the leading bits and fills the rest with randomness. That single change means v7 values sort in roughly the order they were created, which matters a great deal if the identifier becomes a primary key. Random v4 keys scatter inserts across a database index; time-ordered v7 keys append to the end of it, which keeps the index compact and inserts fast on large tables.
What a UUID is not
A UUID is unique, not secret and not unguessable in the way a token should be. A v7 value openly encodes its creation time, and even a v4 value is fine to log, put in a URL or show on screen — but it is an identifier, not an authorisation. If a request needs to prove who is making it, that needs a signed token or a session, not a UUID in a query string.
They are also not free. Thirty-six characters with hyphens, or sixteen bytes stored as binary. On a small table that is irrelevant; on a table with hundreds of millions of rows, storing them as text rather than binary is a decision you will notice.
Common questions
What is a UUID?
A Universally Unique Identifier — a 128-bit value, usually written as 32 hex digits in five groups, designed so that generating one anywhere is astronomically unlikely to collide with one generated anywhere else.
Is this random enough for real use, like database keys?
Yes. It uses crypto.randomUUID(), the browser's built-in cryptographically secure random number generator — the same class of randomness used for encryption keys, and the standard way modern browsers generate version-4 UUIDs.
What's the difference between a UUID and a GUID?
They're the same idea under two names. GUID (Globally Unique Identifier) is Microsoft's term; UUID is the more general, cross-platform name defined in the RFC 4122 standard. The format this tool generates works as either.
Should I use v4 or v7 for a database primary key?
Version 7. Its leading timestamp bits make values roughly sortable by creation time, so new rows append to the end of the index instead of scattering through it. On a large table that difference shows up as materially faster inserts and a smaller index.
Can two UUIDs ever be the same?
In theory yes, in practice no. A version 4 UUID has 122 random bits. You would need to generate billions of them per second for decades before a collision became likely enough to plan around. The realistic risk is a broken random source, not the format itself.
Is it safe to put a UUID in a public URL?
As an identifier, yes — it leaks nothing about your data. But it is not a password. Anything reachable purely by knowing its UUID is effectively public to anyone who obtains that value, so access still needs a real permission check behind it.