UUID v4 Generator
How it works
Why Math.random is not a UUID source
A v4 UUID has 122 random bits, and its collision resistance assumes they come from a cryptographically strong source. Math.random is neither cryptographic nor full-width: engines implement it as a small fast PRNG (V8 uses xorshift128+, 64 bits of state) that is predictable from a few outputs and was never designed for uniqueness guarantees. Two tabs seeded alike can collide. crypto.randomUUID draws from the operating system's CSPRNG, which is what the 'practically never collides' math actually relies on.
What the 4 and the 8/9/a/b mean
In 123e4567-e89b-42d3-a456-... the third group always starts with 4 - the version field, marking a random UUID. The fourth group starts with 8, 9, a or b - two fixed variant bits (10xx) from RFC 4122. So of the 128 bits, 6 are structure and 122 are random. Canonical form is lowercase; uppercase is accepted by parsers but lowercase is what RFC 4122 emits, which is why the uppercase toggle exists for systems that store GUIDs uppercased.
FAQ
Can two generated UUIDs collide?
With 122 random bits from a CSPRNG, you would need about 2^61 UUIDs (2.3 quintillion) for a 50% chance of one collision - generating a billion per second for 73 years. Collisions in practice come from broken generators (Math.random, copy-pasted seeds, VM snapshots), not from v4 itself.
Are these UUIDs generated on a server?
No. crypto.randomUUID runs in your browser against your OS's cryptographic random source. The page ships a strict Content-Security-Policy: connect-src 'none' blocks fetch, XHR, WebSockets and beacons, while default-src 'self' and form-action 'none' block every other way markup could send data off-site - so a generated id cannot leak.
Should ids be lowercase or uppercase?
RFC 4122 outputs lowercase and recommends case-insensitive comparison on input. Some ecosystems (Microsoft GUID tooling, some databases) display uppercase. Pick one casing for storage and compare case-insensitively at boundaries; the Uppercase toggle covers the uppercase-storing systems.
Why is there no v1 (timestamp) UUID here?
v1 embeds the generation time and historically the MAC address - an information leak that has deanonymized documents before. v4 carries no metadata. If you need time-sortable ids, look at UUIDv7, which keeps the timestamp but replaces the MAC with random bits.