What is a UUID?
UUID stands for Universally Unique Identifier. It's a 128-bit number, typically displayed as 32 hexadecimal digits in five groups separated by hyphens: 8-4-4-4-12. The format is standardized in RFC 4122.
The defining property of a UUID is that it's unique — not just within your database or your application, but in theory across all systems that generate UUIDs. The probability of generating two identical UUID v4s is so small (1 in 5.3×10^36) that it's treated as impossible in practice.
Why use UUIDs instead of sequential integers?
Sequential IDs (1, 2, 3...) are simple and efficient in a single database, but they create problems at scale. They reveal information about your data — a user with ID 12 can infer that only 11 users signed up before them. They create security issues when IDs appear in URLs (someone can easily enumerate resources by incrementing the number). And they become a coordination problem in distributed systems where multiple databases or services need to assign IDs independently.
UUIDs solve all of these problems. They can be generated anywhere — in the client browser, in different microservices, in separate database servers — without any central coordination, and collisions are practically impossible. The trade-off is that they're larger (16 bytes vs 4 bytes for a 32-bit integer) and don't sort naturally by creation time.
UUID versions — v1, v4, v7, and what's different
UUID v1 includes the machine's MAC address and a timestamp. This makes them time-sortable, which is useful for database indexing, but it exposes the generating machine's network address — a privacy concern that led to limited adoption.
UUID v4 is the most common version. It's generated from random bytes. The only structure is a few fixed bits that identify the version and variant. Because it's purely random, it has no inherent ordering, which can hurt database index performance at high insert rates.
UUID v7 is a newer standard that combines a Unix timestamp with random bits. This gives you UUIDs that sort chronologically — making them database-friendly like v1 — without exposing any hardware information. If you're starting a new project, v7 is worth considering. For most existing use cases, v4 is fine.
How UUIDs are generated in a browser
The Web Crypto API, which is built into every modern browser, provides `crypto.randomUUID()` — a native method that generates cryptographically secure UUID v4 strings. This is the same API used by the UUID Generator on Irreva.
Because the generation uses the browser's secure random number generator, there's no server involved and no possibility of the same UUID being returned to two different callers. The method is also fast — generating thousands of UUIDs takes milliseconds.