UUID Generator: Create Unique Identifiers Correctly
uuid generator: Generate a UUID for records and requests, choose the right version, and avoid treating an identifier as a secret or access token.

A UUID is a 128-bit identifier used to label records, events, and resources across systems. The right generation method depends on whether you need random uniqueness, time ordering, or a deterministic value from a namespace and name. UUIDs reduce collision risk but do not replace database constraints or authorization. Use a standards-compliant generator, store the value in a suitable field, and keep the version and format consistent across services.
Choose a UUID version for the use case
Random UUIDs are useful when identifiers should be created independently without a central counter. Name-based versions produce the same UUID for the same namespace and input under the chosen hash method. Time-ordered versions can improve locality in some databases, but they reveal ordering information and have specific implementation rules. Confirm what your language runtime and storage system support before choosing a version.
Generate with a secure, trusted library
Use an operating-system-backed or well-maintained library rather than building random bits by concatenating timestamps and Math.random values. A compliant generator sets version and variant bits correctly. Add a unique constraint in the database so a collision fails safely instead of overwriting an existing row. Validate UUID strings at system boundaries and normalize case only if the surrounding format permits it.
Do not use a UUID as authorization by itself
An identifier is not automatically a secret. If someone can guess, obtain, or copy a UUID, it should not grant access unless your security model intentionally treats it as a capability and protects it accordingly. Enforce access checks for every resource request. Avoid exposing internal identifiers unnecessarily, and do not rely on their length or randomness as a substitute for authentication, authorization, or token expiration.
Worked example
Example UUID v4:
550e8400-e29b-41d4-a716-446655440000
Use: order.id
Database: enforce uniqueness
Security: check user authorization separatelyCan two UUIDs be identical?
A collision is possible in principle, though a correctly generated random UUID has a very low collision probability. Keep a uniqueness constraint.


