Generating a v4 UUID
A v4 UUID is 122 random bits packed into the standard 32-hex-digit, hyphenated format, with 6 fixed bits identifying the version and variant:
f47ac10b-58cc-4372-a567-0e02b2c3d479
^
version nibble = 4
The randomness source matters more than it might seem: a cryptographically secure random number generator (like crypto.getRandomValues() in the browser, or crypto/rand in most server languages) is required for the collision-resistance guarantees to actually hold — using a non-cryptographic pseudorandom generator (like a basic Math.random()) produces UUIDs that look identical but carry much weaker uniqueness guarantees, since some such generators have far smaller effective randomness or predictable patterns.
Generating a v7 UUID
A v7 UUID embeds the current Unix millisecond timestamp in its leading 48 bits, with the remaining bits random:
018e5a4b-8c3d-7000-8a1b-3c4d5e6f7890
└────timestamp────┘ ^
version nibble = 7
Generating one is straightforward: take the current timestamp, pack it into the leading bits per the spec's exact byte layout, fill the remainder with cryptographically secure random bits, and set the version/variant nibbles correctly. Most modern UUID libraries (Node's built-in crypto.randomUUID variants, or dedicated packages) now support v7 generation directly, since it's a relatively recent (2024) standardization.
Choosing which to generate
| If you need... | Generate |
|---|---|
| No ordering requirement, maximum simplicity | v4 |
| A database primary key on a high-write table | v7 (better index locality — see UUID v4 vs v7) |
| To avoid leaking creation time in the identifier | v4 (v7's timestamp is directly readable) |
| Log/event IDs where chronological sortability helps | v7 |
Common mistakes
- Using a non-cryptographic random source for v4 generation. This weakens the collision-resistance guarantee that makes v4 UUIDs safe to treat as effectively unique.
- Assuming any 32-hex-digit hyphenated string is a valid UUID. The version and variant nibbles need to be set correctly for it to conform to the actual UUID spec, not just look like one.
- Generating v7 UUIDs when hiding creation time matters. The embedded timestamp is plainly readable — if that's undesirable, v4 doesn't have this property.
FAQ
What's the minimum requirement for generating a valid v4 UUID?
122 bits of cryptographically secure randomness, with the version (4) and variant bits set correctly in their designated positions.
Do I need a special library to generate v7 UUIDs?
Not necessarily — many modern language standard libraries and UUID packages now support v7 directly, since it was standardized in 2024, but older tooling may only support v4.
Can I tell which version a UUID is just by looking at it?
Yes — the first character of the third hyphenated group is the version nibble (4 or 7 in this comparison), always in that fixed position.
Generate v4 and v7 UUIDs instantly with the UUID Generator — created entirely in your browser using a cryptographically secure random source.