UUID Guides

Everything you need to use UUIDs correctly in a real project: how to store them efficiently, what they do and do not protect, and how to generate them across languages and frameworks.

What these guides cover

UUID generation is a single function call in most languages. The harder questions are about what happens next: which column type to use, why your database index slows down after a million rows, what a UUID in a URL actually leaks, and when to reach for v7 instead of v4. These guides answer those questions with concrete recommendations rather than general overviews.

Choosing the right UUID version

The practical choice for new projects in 2026 is between v4 and v7. UUID v4 is 122 bits of cryptographic randomness — unpredictable, no timestamp, nothing derivable about when or where it was created. UUID v7 embeds a 48-bit Unix millisecond timestamp in its leading bits, making it time-sortable and index-friendly. The UUID Versions guide covers all eight versions defined by RFC 9562, including which are deprecated (v1, v2, v6) and when name-based v5 is the right choice.

UUIDs and database performance

Random UUID v4 primary keys cause B-tree page splits on every insert because each new value lands at a random position in the index. At scale — hundreds of thousands of rows — this fragments the index, increases cache misses, and measurably slows both writes and range reads. UUID v7 eliminates this problem: its timestamp prefix means consecutive inserts cluster near the end of the index, producing behaviour close to an auto-increment integer. The UUID in Databases guide covers storage types, index behaviour, and migration paths for PostgreSQL, MySQL, SQLite, SQL Server, and MongoDB.

Security and what UUIDs are not

A UUID is an identifier, not a secret. Even UUID v4, with its 122 bits of randomness, should not be used as a session token or capability grant on its own — UUIDs appear in URLs, server logs, referrer headers, and anywhere HTTP traffic is recorded. The UUID Security guide explains what v4 actually guarantees, what v7 leaks (creation timestamp to the millisecond), and what to use instead when you genuinely need a secret.

Language guides

Each language guide shows the idiomatic way to generate, parse, and store UUIDs — covering the standard library where it exists and the canonical third-party package where it does not. All guides include v7 examples, database storage patterns, and framework-specific integration (ORMs, web frameworks, type systems).

• JavaScript / Node.js — crypto.randomUUID(), the uuid npm package, React, Vue, Prisma, Drizzle
• Python — built-in uuid module, v7 in Python 3.13+, Django, SQLAlchemy, Pydantic, FastAPI
• Go — google/uuid, pgx, database/sql, GORM, structured logging