What is a UUID v4?

A standard shape for identifiers

A UUID is a 128-bit identifier commonly written as 32 hexadecimal digits separated into groups of 8, 4, 4, 4, and 12. A version 4 UUID uses random bits, with specific bits reserved for its version and variant.

b55b7594-5292-4a3e-9f5c-61c18c039431
                  ↑ version 4

Generate with secure randomness

Use crypto.randomUUID() in a secure browser context. A fallback must use crypto.getRandomValues and correctly set the version and variant bits. Math.random is not suitable for secure UUID generation.

Very unlikely does not mean impossible

Version 4 offers 122 random bits. Independently generated values have an extremely low collision probability, but applications should still enforce uniqueness where it matters, such as a database unique constraint.

Identifiers are not authorization

A UUID can label an object without granting access to it. Validate permissions on every protected operation. Do not treat a hard-to-guess identifier as a replacement for authentication or access checks.