UUID v4: A Practical Guide to Random Identifiers

A UUID is a 128-bit identifier written in a familiar hexadecimal form such as `xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx`.

What version 4 means UUID v4 uses random bits, with a small number of bits reserved for the version and variant. A cryptographically secure random generator makes collisions extremely unlikely for normal application volumes.

Good use cases UUIDs are useful when multiple systems create records independently, when sequential IDs would reveal ordering, or when a public identifier should not expose a simple database counter.

What UUIDs do not guarantee A UUID is not an authentication token. Although a v4 identifier is hard to guess, access control must still be enforced by your application. Do not treat an identifier as permission.

Storage considerations Databases can store UUIDs as strings, native UUID types or compact binary values. Native types are usually easier to validate and more space-efficient than 36-character strings.

Browser generation Modern browsers provide `crypto.randomUUID()`. Older environments can generate compatible values from secure random bytes, but should avoid weak sources such as `Math.random()` for security-sensitive identifiers.