Generators

UUID Generator: Create Unique Identifiers Correctly

uuid generator: Generate a UUID for records and requests, choose the right version, and avoid treating an identifier as a secret or access token.

Photorealistic editorial photo for How To Generate Uuid
Generators · Practical ideas for your next build

A UUID is a 128-bit identifier used to label records, events, and resources across systems. The right generation method depends on whether you need random uniqueness, time ordering, or a deterministic value from a namespace and name. UUIDs reduce collision risk but do not replace database constraints or authorization. Use a standards-compliant generator, store the value in a suitable field, and keep the version and format consistent across services.

Choose a UUID version for the use case

Random UUIDs are useful when identifiers should be created independently without a central counter. Name-based versions produce the same UUID for the same namespace and input under the chosen hash method. Time-ordered versions can improve locality in some databases, but they reveal ordering information and have specific implementation rules. Confirm what your language runtime and storage system support before choosing a version.

Generate with a secure, trusted library

Use an operating-system-backed or well-maintained library rather than building random bits by concatenating timestamps and Math.random values. A compliant generator sets version and variant bits correctly. Add a unique constraint in the database so a collision fails safely instead of overwriting an existing row. Validate UUID strings at system boundaries and normalize case only if the surrounding format permits it.

Do not use a UUID as authorization by itself

An identifier is not automatically a secret. If someone can guess, obtain, or copy a UUID, it should not grant access unless your security model intentionally treats it as a capability and protects it accordingly. Enforce access checks for every resource request. Avoid exposing internal identifiers unnecessarily, and do not rely on their length or randomness as a substitute for authentication, authorization, or token expiration.

Worked example

EXAMPLE
Example UUID v4:
550e8400-e29b-41d4-a716-446655440000

Use: order.id
Database: enforce uniqueness
Security: check user authorization separately

Can two UUIDs be identical?

A collision is possible in principle, though a correctly generated random UUID has a very low collision probability. Keep a uniqueness constraint.

Reference and further reading

Read the official documentation ↗