UUID v4 vs UUID v7: Generating Cryptographically Secure Identifiers in the Browser

Many online tools generate UUID identifiers using non-cryptographic random functions like Math.random(). This creates predictable values that are unsuitable for database primary keys, session tokens, or API secrets.

The Vulnerability of Standard PRNGs

JavaScript's Math.random() uses pseudorandom algorithms (typically xorshift128+) designed for speed, not security. If an attacker collects several sequential IDs, they can deduce the internal state of the generator and predict upcoming values, exposing session IDs or password-reset tokens to hijacking attacks.

Cryptographically Secure Random Generation (CSPRNG)

For security-critical tasks, applications must use Cryptographically Secure Pseudorandom Number Generators (CSPRNG). The browser's native Web Crypto API retrieves entropy from operating system hardware sources, producing unpredictable values suitable for security tokens.

// Generating cryptographically secure UUID v4 natively
function generateSecureUUIDv4() {
  return crypto.randomUUID();
}

UUID v4 (Random) vs UUID v7 (Time-Ordered)

While UUID v4 generates 122 bits of pure random entropy, UUID v7 incorporates a 48-bit Unix timestamp prefix followed by random bits (RFC 9562). This time-ordered sequence prevents B-tree index fragmentation in relational databases (PostgreSQL, MySQL, SQL Server), significantly improving write performance while maintaining global uniqueness.

Use our client-side UUID Generator to bulk generate cryptographically secure UUID v4 and v7 identifiers offline.

Frequently Asked Questions

What makes UUID v7 better for database indexes?

Because UUID v7 starts with a timestamp prefix, generated keys increase sequentially over time. This prevents database index fragmentation and speeds up B-Tree index inserts compared to random UUID v4 values.

Is crypto.randomUUID() supported across browsers?

Yes. crypto.randomUUID() is part of the standard Web Crypto API and is supported in modern browsers, Node.js, and Deno environments.

Can database UUID collisions occur?

The probability of collision in UUID v4 is negligible. Reaching a 50% chance of a single collision requires generating approximately 2.7 quintillion UUIDs.