Question 1

Which UUID version should I use?

Accepted Answer

Version 4 unless you have a reason to choose otherwise: it is 122 random bits, it is what almost every library means by "a UUID", and nothing about it can be derived from anything else. The reason to choose otherwise is usually a database. A v4 UUID lands at a random point in an index, so a table keyed on one splits pages all over the place as it grows, while version 7 puts 48 bits of the current time in front and inserts land next to each other. Version 5 is for a different question again: it hashes a name rather than inventing anything, so the same name always gives the same UUID, on this page and in Python and in Postgres. Versions 1 and 6 carry the time and a node identifier and are mostly encountered rather than chosen.

Question 2

What is the difference between UUID v7, ULID and KSUID?

Accepted Answer

They answer the same question and differ in how they are written down. All three put a timestamp at the front so that ids sort into the order they were made. A v7 UUID is 36 characters in the usual hyphenated shape, which every database, language and log viewer already understands. A ULID is 26 characters of Crockford base 32, which has no I, L, O or U in it, so it survives being read aloud or typed back in from a screenshot. A KSUID is 27 characters of letters and digits only, with no punctuation at all, so it passes through a URL, a shell and a spreadsheet untouched; it is ordered to the second rather than the millisecond. If the id will be handled mostly by machines, v7 is the safe choice. If people will read it, ULID.

Question 3

Why would I use NanoID instead of a UUID?

Accepted Answer

Length, mostly. A NanoID is 21 characters against a UUID's 36, and it still carries 126 bits of randomness where a v4 UUID carries 122, so it is shorter and marginally harder to guess at the same time. Its alphabet is A-Z, a-z, 0-9 and two punctuation marks that survive a URL and a filename, so there is nothing to escape and no hyphens to be lost when someone double clicks it. The trade is that it is a convention rather than a standard: no database has a native type for it, and nothing will parse it back into a timestamp or a version. Use it for share links, public ids and anything a person will see, and keep UUIDs where a schema or another system expects one.

Question 4

How many can I generate before two of them collide?

Accepted Answer

For the random formats, more than you will ever generate. A v4 UUID and a 21-character NanoID both carry over 120 random bits, which means you could generate a billion ids a second for a century and still be more likely to be hit by a meteorite than to see a repeat. The formats with a counter or a timestamp in them are protected differently: version 7 UUIDs and ULIDs made in the same millisecond are kept apart and in order by a counter, and an ObjectId uses five bytes that stand for whoever generated it plus a counter that increments. Shortening a NanoID is the one way to get into trouble here: at 8 characters a few thousand ids will collide, so keep the default unless something else in your system is already keeping them apart.

Question 5

Are these safe to use as secret tokens or session ids?

Accepted Answer

Every value on this page comes from your browser cryptographic random source, the same one used for TLS keys, so the random ones are unpredictable. That makes v4 UUIDs and NanoIDs reasonable session tokens. The time-ordered formats are a different matter: v1, v6, v7, ULID, KSUID and ObjectId all carry the moment they were made in plain sight, and the counters make consecutive ids partly guessable, so treat them as identifiers rather than as secrets. Versions 3 and 5 are not secret at all by design, since anyone with the name can compute the same UUID.

Question 6

Is anything sent to a server?

Accepted Answer

No. Every format here is generated in your browser and nothing leaves the page: no network request is made when you press the button, and the list is gone when you reload. That is also why the page will not work over plain HTTP: the cryptographic random source is only available in a secure context, and a generator falling back to a weaker source without saying so would produce ids that look identical and collide.

UUID Generator

About UUID Generator

Which one should I use?

UUID Format:

The UUID versions:

The shorter formats:

Common Use Cases: