crypto.randomUUID() — Browser and Runtime Support

crypto.randomUUID() shipped in Chrome 92 in July 2021. By 2022 it had landed in Firefox, Safari, and Edge, making it a Baseline feature — meaning you can use it without a polyfill in any browser released in the last few years. This article documents the full support matrix across browsers and server runtimes, explains the remaining gaps, and clarifies when you still need a library.

Browser support matrix

Baseline status: Widely available. No polyfill needed for any browser released after mid-2022.

Secure context requirement: crypto.randomUUID() is only available on HTTPS origins and localhost. It throws a TypeError on HTTP pages. This is by design — the Web Crypto API is restricted to secure contexts to prevent exposing cryptographic operations over unencrypted connections.

Node.js support

From Node.js 19, globalThis.crypto is a global Crypto object matching the Web Crypto API, so code written for browsers works in Node without modification.

// Works in browsers and Node.js 19+
const id = crypto.randomUUID();

// Works in Node.js 14.17+ and browsers
const { randomUUID } = require('node:crypto'); // or import
const id = randomUUID();

Deno and Bun

Both runtimes match the browser API exactly. Code using crypto.randomUUID() runs unchanged across browsers, Node.js 19+, Deno, and Bun.

What crypto.randomUUID() does not do

crypto.randomUUID() generates UUID v4 only. It does not:

• Generate UUID v7 (no timestamp prefix, no sort order)
• Accept options (no version selection, no namespace)
• Work in HTTP contexts (secure context required)
• Work in older environments (IE, Node.js below 14.17)

For UUID v7, use the uuid npm package (v7()) or implement the RFC 9562 §5.7 layout directly — it is about 15 lines of code.

Comparing crypto.randomUUID() to the uuid package

For applications that only need UUID v4, crypto.randomUUID() is the correct choice — no dependency, no bundle cost, cryptographically secure. For applications that need v7 (database primary keys) or v5 (deterministic name-based UUIDs), the uuid package is required.

A minimal UUID v7 implementation

If you want UUID v7 without a dependency, here is a compliant implementation in under 20 lines:

function uuidv7() {
  const bytes = crypto.getRandomValues(new Uint8Array(16));
  const ms = Date.now();

  // Timestamp (48 bits)
  bytes[0] = (ms / 2 ** 40) & 0xff;
  bytes[1] = (ms / 2 ** 32) & 0xff;
  bytes[2] = (ms / 2 ** 24) & 0xff;
  bytes[3] = (ms / 2 ** 16) & 0xff;
  bytes[4] = (ms / 2 **  8) & 0xff;
  bytes[5] =  ms            & 0xff;

  // Version 7
  bytes[6] = (bytes[6] & 0x0f) | 0x70;
  // Variant bits (RFC 9562)
  bytes[8] = (bytes[8] & 0x3f) | 0x80;

  return [...bytes].map((b, i) =>
    ([3,5,7,9].includes(i) ? '-' : '') + b.toString(16).padStart(2, '0')
  ).join('');
}

This implementation does not include the RFC 9562 §6.2 monotonic counter (which prevents out-of-order values within the same millisecond). For production use where sub-millisecond ordering matters, use the uuid package which implements Method 1 correctly.

Further reading

• UUID in JavaScript — full guide to crypto.randomUUID(), the uuid package, and framework patterns
• UUID v7 ORM Support in 2026 — Prisma and Drizzle UUID v7 configuration
• UUID Security — when a UUID is not enough as a secret