UUID Generator — v4 and v7, Cryptographically Random

Two versions, two different jobs

A UUID is 128 bits formatted as 32 hex digits in five dash-separated groups. Six versions exist; two of them matter for everyday application code, and choosing between them has real consequences for your database.

Version 4 — pure randomness

Version 4 is 122 random bits with six bits reserved for the version and variant markers. It carries no information about when or where it was created, which is exactly what you want for a public identifier: a v4 in a URL tells an observer nothing about how many records you have or when this one was made.

The randomness here comes from crypto.getRandomValues, the platform CSPRNG — the same source your browser uses for TLS. Many hand-rolled generators still use Math.random, which is not cryptographically random and can repeat in predictable ways. With proper randomness, you would need to generate on the order of a billion UUIDs per second for a century before collision probability became meaningful.

Version 7 — time-ordered

Version 7 replaces the leading 48 bits with a Unix millisecond timestamp, filling the rest with randomness. The result still looks like a UUID and fits the same column, but sorts chronologically as a string or as bytes.

That property matters more than it sounds. When a table's primary key is random, every insert lands at an arbitrary point in the B-tree index, scattering writes across pages and fragmenting the index as the table grows. Sequential keys append to the end, keeping inserts cheap and the index compact. On a write-heavy table this is the difference between an index that stays healthy and one that needs periodic rebuilding.

The trade-off is that a v7 leaks its creation time to anyone who can read it. Use v7 for internal primary keys, and v4 for anything user-facing where that leak matters.

Generated here, seen by nobody

Identifiers are generated in your browser and never transmitted. That matters less for a UUID than for a password, but the principle is the same: a tool that generates values on a server is a tool whose operator has seen every value it ever produced.

Questions people actually ask

Are these UUIDs safe to use as database keys?

Yes. They come from crypto.getRandomValues, the same CSPRNG the browser uses for TLS — not Math.random. Collision probability for v4 stays negligible well past any realistic row count.

When should I choose v7 over v4?

Version 7 embeds a millisecond timestamp in the high bits, so IDs sort chronologically. That keeps B-tree index inserts sequential instead of scattering them, which matters a lot for write-heavy tables. Use v4 when you want no time information leaking into the ID.

Can I generate more than one at a time?

Yes — set the count and generate up to 1,000 at once, then copy the whole block or download it as a text file.