Recognize the format
A canonical UUID is written as hexadecimal groups separated by hyphens. The familiar grouping is 8-4-4-4-12 characters. The hyphens help readability; they do not add randomness. Version and variant bits identify how the remaining bits should be interpreted.
In a v4 UUID, the first character of the third group is 4. The variant makes the first character of the fourth group one of 8, 9, a or b. These visible patterns are normal. Rejecting an identifier because it contains a predictable version digit would misunderstand the format.
Use the browser’s cryptographic source
Our generator draws 16 random bytes from crypto.getRandomValues and then sets the required version and variant bits. It does not use the current time, a username or Math.random as a substitute. If the cryptographic source is unavailable, generation fails visibly.
A secure context is the right environment for these tools. Keep the browser and its dependencies updated, and treat copied identifiers like any other data in the clipboard. Random generation is one part of a system; transport, storage and validation still need ordinary engineering care.
Try it with your own input
Your result
Very unlikely is not impossible
With 122 random bits, the identifier space is enormous. Collision probability depends on the number of identifiers generated and on the quality and independence of the random draws. It is not a guarantee that a duplicate can never occur.
For a database that requires uniqueness, use a unique constraint and handle an insertion conflict. That turns a probabilistic expectation into an enforced storage rule. Avoid checking for a duplicate in one query and inserting in another without protection: concurrent writers can both pass the check. The database should own the invariant.
Do not confuse identity with authority
A random document ID can make casual guessing difficult, but it does not establish who owns that document. A server must still check whether the current user is allowed to read or change it. Leaked links, logs, browser history and shared screenshots can reveal an identifier.
Use a dedicated access token when your design intentionally grants access by possession, with appropriate lifetime and revocation rules. A UUID can be part of that system, but its format alone does not supply those rules. The password guide discusses credentials as a different task.
Choose a version for the actual requirement
Version 4 is useful when independent random identifiers are enough. Other UUID versions encode different information or support different ordering properties. Do not assume that a v4 UUID sorts chronologically, contains a creation date or identifies the device that generated it.
If an application needs time ordering, examine its storage and interoperability requirements before choosing a different format. For an actual creation time, store an explicit timestamp in a separate field. The timestamp guide shows why that field’s unit and timezone contract should be clear.
Generate and verify a batch
Choose a batch size, generate the IDs and copy the newline-separated result. For a fixture, check the version and variant patterns and ensure the batch contains no duplicates. A small batch with no duplicates is a sanity check, not a statistical proof of the random generator.
Keep identifiers as strings when moving them through a spreadsheet or CSV file. Avoid truncating them for a column width or treating hyphens as arithmetic operators. Use the CSV converter to preserve text fields, and keep the original representation if an external system requires a particular casing.
Common questions
Why is one digit always 4?
That digit identifies UUID version 4. Fixed version and variant bits are part of the format.
How many random bits does v4 contain?
It contains 122 random bits out of 128 total bits.
Can UUIDs collide?
Yes in principle. The probability is tiny for ordinary volumes with sound randomness; enforce a unique constraint when the system requires uniqueness.
Does a UUID protect a private document?
No. The application must still check authorization for the requested document.
Can I recover a creation date from v4?
No. Version 4 is random and does not encode a creation timestamp. Store that separately.