Why use UUIDs instead of auto-increment IDs
Auto-increment IDs are fine inside a single database, but they leak information (your customer count, your request rate) and make it painful to merge data from two systems. UUIDs can be created anywhere - a client, a worker, an offline device - and still never collide.
Version 4 UUIDs are random. They carry no timestamp or machine identity, so they do not leak when an ID was created or where.
The security rule: crypto randomness, not Math.random
If a UUID doubles as a security token - a password reset, an invite link, an API key - it must be unguessable. Math.random is not: its output can be predicted once its state is known. Real UUID generators use a cryptographically secure source.
In the browser that is crypto.getRandomValues, the same source behind TLS. If your generator does not use it, do not use your generator for security-sensitive IDs.
Format consistently so merges do not become diffs
- Decide once: lowercase with hyphens (standard), uppercase, or wrapped in {braces}.
- Set the same convention in every service that stores or generates UUIDs.
- Generate the whole batch in one run so the formatting is identical - then paste into seed scripts, SQL INSERTs, or fixtures.
Generate a batch locally
- Open a UUID generator (IDMint runs entirely in your browser).
- Set the count and the formatting options you settled on.
- Press Generate, then copy all or download a .txt for scripts and fixtures.
Generate UUIDs in bulk, locally
Frequently asked questions
Are UUIDs actually guaranteed unique?
Version 4 uses 122 random bits. The probability of collision is so low that it is effectively impossible for real workloads - vastly below the chance of a hardware failure corrupting the same record.
What is the difference between v1 and v4?
v1 encodes a timestamp plus machine identity, which leaks creation time and host. v4 is fully random. For almost every application v4 is the right choice.
Can I use the same UUID generator for tokens?
Yes, as long as it uses cryptographically secure randomness. Treat the output as a random token with the usual length caveats - a UUID is 122 bits, which is strong.
Does generating UUIDs locally mean they are less unique?
No. The randomness is generated on your device by the operating system's secure random source, which is exactly where uniqueness comes from.