What makes a UUID version 4
A version 4 UUID is almost entirely random. Of its 128 bits, six are fixed to mark the version and variant, and the other 122 come from a cryptographically secure random source. You can recognize one by the digit 4 at the start of the third group, as in 3b241101-e2bb-4255-8caf-4136c566a962, and by an 8, 9, a, or b at the start of the fourth group.
Because nothing in the value depends on time, location, or hardware, two version 4 UUIDs never reveal anything about where or when they were created. That makes version 4 the safest default for identifiers that appear in public URLs, API responses, invitation links, and file names.
How unique is a random UUID?
With 122 random bits there are about 5.3 × 10^36 possible version 4 UUIDs. To reach even a 50 percent chance of a single collision, you would need to generate roughly 2.7 quintillion of them. In practical terms, if every service you run generated a billion UUIDs per second, a duplicate would still be extremely unlikely for decades.
That guarantee only holds when the randomness is genuine. This generator uses the browser Web Crypto API, the same source of randomness used for encryption keys. Avoid hand-written snippets that build UUIDs from Math.random(), which is predictable and far more likely to repeat.
When to choose version 4
Version 4 is the right choice for public identifiers, correlation and request IDs, idempotency keys, test fixtures, and any situation where you want an opaque value that says nothing about its origin. It is supported by every major language, framework, and database without extra libraries.
The one trade-off is ordering. Random values land at unpredictable positions in a database index, which can slow down inserts on very large, write-heavy tables. If your UUIDs are primary keys in such a table, consider version 7 instead, or keep version 4 for the public identifier and a time-ordered key internally.
Generating version 4 in code
Most platforms have a built-in version 4 generator: crypto.randomUUID() in browsers and Node.js, uuid.uuid4() in Python, UUID.randomUUID() in Java, Guid.NewGuid() in .NET, and gen_random_uuid() in PostgreSQL 13 and later. For scripts, https://utilistudio.com/api/uuid?version=4 returns a fresh value as plain text.
