What is a UUID?
A UUID (Universally Unique Identifier), also called a GUID on Microsoft platforms, is a 128-bit value designed to be unique without a central authority. You'll see them written as 32 hexadecimal digits separated by hyphens in an 8-4-4-4-12 pattern: 550e8400-e29b-41d4-a716-446655440000. UUIDs are used as primary keys, session tokens, file names, event IDs — any place where two independent systems might create records simultaneously and need to avoid collisions.
UUID v4 vs v7
UUID v4 is fully random (122 bits of randomness plus 6 version/variant bits). Its strength is simplicity and unpredictability, but random UUIDs make terrible database primary keys — every insert jumps to a random location in a B-tree index, causing page splits and poor cache locality.
UUID v7 (standardized in RFC 9562, May 2024) solves this by embedding a 48-bit Unix millisecond timestamp in the first bits, followed by random data. The result sorts roughly in creation order, so inserts append to the end of the index instead of jumping around. Modern Postgres, MySQL, and NoSQL stores all benefit. Use v7 for new database IDs; use v4 when you specifically want unpredictability (session tokens, share URLs, password reset nonces).
Cryptographic security
This generator uses crypto.getRandomValues() — the browser's CSPRNG, the same source used for generating encryption keys. The output is safe to use as a session identifier or one-time token. All computation is client-side: no UUID you generate here is ever transmitted to a server.