What the versions mean
A UUID is 128 bits with four of them reserved to say which scheme produced it.
- v4 — 122 random bits. No structure, no ordering, no information.
- v7 — 48 bits of Unix milliseconds followed by random bits. Sorts in creation order as plain text.
The other versions exist (v1 embeds a MAC address, v5 hashes a namespace) but these two cover nearly every practical need.
Why v7 matters for a database
A B-tree index stores keys in order. With v4 primary keys, every insert lands at a random point in the index, which means constant page splits and a working set that grows to the size of the whole table. With v7, inserts append to the end, the way an auto-increment integer does — but without coordinating with the database to get the next value.
That is the real advantage over an integer key: an application, a queue worker or an offline client can mint an identifier without asking anyone.
Formatting
The canonical form is 36 characters, lowercase, with hyphens. Braces and uppercase are Microsoft conventions and still appear in .NET and COM code, which is why both are options here — but if you have a choice, stay canonical.
Questions
v4 or v7?+
v7 if the identifier will be a database primary key, v4 for everything else. v7 puts a millisecond timestamp in the leading bits, so values sort chronologically and new rows land at the end of the index. v4 is uniformly random, which scatters inserts across the whole index and fragments it.
Does v7 leak information?+
It reveals when the identifier was created, to the millisecond. That is usually harmless and occasionally not — a v7 order number tells a customer how many orders you took that second. Use v4 where the creation time is sensitive.
Can two of these collide?+
v4 has 122 random bits. You would need to generate a billion per second for about 85 years to reach a 50% chance of one collision. It is not a risk worth engineering around.
Is the randomness real?+
It comes from `crypto.getRandomValues`, the browser's cryptographic generator, not `Math.random()`. The values never leave your device, so nothing here has seen the identifiers you generate.