UUID Security — Tokens, Secrets, and What v7 Leaks

What This Video Covers

UUID security videos cover a topic that is frequently misunderstood: the difference between an identifier and a secret, what UUID v7’s timestamp leaks, and the correct tool for each use case.

Skill level: Intermediate Best for: Backend developers designing APIs, authentication systems, or payment integrations

Key Concepts You Will Learn

1. Identifiers vs secrets — the core distinction

A UUID identifies a resource. A secret authenticates access to it. These are different properties:

2. What UUID v7 timestamps leak

The first 12 hex characters of a UUID v7 are the Unix millisecond timestamp. Extract it:

function extractTimestamp(uuid) {
  return parseInt(uuid.replace(/-/g, '').slice(0, 12), 16);
}

// → 1716297600000  (exact creation time in ms)
new Date(extractTimestamp('018fbe3a-4c5d-7b12-8abc-0123456789ab'));

For internal primary keys this is fine — creation time is not sensitive data. For share links or public IDs, use UUID v4. See UUID Security for the full analysis.

3. Idempotency keys — always use UUID v4

An idempotency key must be unguessable. UUID v7’s timestamp makes the search space smaller for a potential attacker targeting a known time window. Always use UUID v4 for idempotency keys:

const idempotencyKey = crypto.randomUUID(); // UUID v4 — safe

See UUID as Idempotency Keys for the full pattern with Redis and PostgreSQL storage.

4. Real secrets need a different tool

For session tokens, password reset links, and capability grants, use a dedicated cryptographic token:

// Node.js / browser — 32 random bytes → 43-char base64url
const bytes = new Uint8Array(32);
crypto.getRandomValues(bytes);
const token = btoa(String.fromCharCode(...bytes))
  .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

Store a hash (sha256(token)) server-side — never the raw token. This way, a database breach does not expose valid tokens.

5. The variant field and UUID forgery

A UUID validator checks the variant bits (position 17 must be 8, 9, a, or b) and version (position 13 must be 1–8). But passing validation does not mean the UUID was legitimately generated — anyone can craft any bit pattern. Do not use UUID validation as an authorization check. See UUID Variant and the UUID Validator tool.

Related Reading

• UUID Security — full guide
• UUID as Idempotency Keys
• UUID v4 vs v7 — when each is correct
• UUID Entropy — the 122 random bits in v4
• UUID Byte Layout — where the timestamp lives in v7

Watch on YouTube

Search for UUID security and tokens videos on YouTube ↗

Tools

• Generate a UUID v4 — unpredictable, no timestamp
• UUID Decoder — see what a UUID discloses about itself
• UUID Validator — check version and variant bits