v4 or v7?
UUID v4 is 122 bits of randomness. Use it when you need an opaque identifier that reveals nothing. UUID v7 (RFC 9562, 2024) starts with a 48-bit Unix millisecond timestamp, so new IDs sort after old ones. That keeps B-tree indexes compact in PostgreSQL, MySQL and SQLite, which makes v7 the better default for database primary keys. The catch is that v7 reveals when the ID was created.
How these are generated
Random bits come from crypto.getRandomValues, the browser's cryptographically secure generator. For v7, IDs created within the same millisecond use a counter in the next 12 bits so they stay in order (RFC 9562, method 1).
FAQ
Can two generated UUIDs collide?
For v4 the chance is negligible: you would need about 2.7 quintillion IDs for a 50% chance of a single collision.
Are UUIDs secret tokens?
No. Use them as identifiers, not as passwords or session tokens; v7 in particular is partly predictable.