UUID v4 Generator
What a UUID v4 is, when to use it, and a generator scoped to this version. Runs in your browser.
What is a UUID v4?
A UUID v4 is a 128-bit identifier built almost entirely from random bits. Of the 128 bits, 6 are fixed by RFC 9562 for the version and variant fields, leaving 122 bits of entropy. That gives 2^122 possible values, about 5.3 undecillion, so collisions are practically impossible.
Where the randomness comes from matters
A v4 UUID is only as good as the random source behind it. In the browser and in Node.js, crypto.getRandomValues and crypto.randomUUID draw from the operating system's CSPRNG, which is unpredictable even to an attacker who has seen millions of prior outputs. Math.random is the opposite: it is a fast, seedable PRNG designed for animations and games, its internal state can be recovered from a handful of outputs, and several engines seed it per-process, so two tabs or two server workers can emit overlapping sequences. Our generator uses crypto.getRandomValues exclusively, and any v4 library worth using does the same. If you inherit code that builds UUIDs from Math.random, treat every ID it ever minted as guessable.
Collision math, and the one place v4 backfires
The birthday bound on 122 random bits says you would need roughly 2.71 quintillion v4 UUIDs before the odds of a single collision reach 50 percent. Generating one billion per second, that takes about 86 years. For any real workload, collisions are a non-issue.
The genuine v4 weakness is different: as a clustered or B-tree primary key, every insert lands on a random index page. On a large Postgres or MySQL table this fragments the index, churns the buffer pool, and can cut bulk-insert throughput by 2 to 4 times versus a sequential key. If your IDs are primary keys on a high-write table, reach for v7 instead and keep v4 for request IDs, tokens in URLs, and anything where ordering is irrelevant.
Frequently asked
- Are UUID v4 collisions possible?
- Theoretically yes, practically no. With 122 random bits there are about 5.3 undecillion possible values, and you would need around 2.71 quintillion UUIDs before collision odds reach 50 percent. That is decades of generating a billion per second. A collision in practice almost always means a broken random source, not bad luck.
- Is crypto.randomUUID the same as UUID v4?
- Yes. crypto.randomUUID, available in Node.js 14.17+ and all modern browsers, returns an RFC 9562 compliant v4 UUID drawn from the platform CSPRNG. It is the correct way to mint v4 in JavaScript today, with no library and no Math.random fallback.
- Should I use UUID v4 as a database primary key?
- It works, but on high-write tables it is the slow option. Random values scatter inserts across B-tree pages, fragmenting the index and evicting hot pages from cache. For primary keys on busy tables, UUID v7 keeps the same 128-bit format while inserting sequentially. Keep v4 for IDs where insert order does not matter.
More in this series
// The subscription desk
The Inference Report
The weekly briefing for AI engineers: model releases, pricing moves, benchmarks, and the news that changes what you should build with and what it costs. Every Tuesday, 5-minute read. No fluff.
Join AI engineers who stopped overpaying for tokens. Unsubscribe anytime.