How Is UUID v4 Generated, and Why Is It Unlikely to Repeat?

UUID v4 has fixed version and variant bits plus 122 random bits. Its enormous random space makes collisions extremely unlikely when the random-number generator is cryptographically strong.

“Practically unique” is probability, not proof. Correct randomness, preserving every bit, database constraints, and system scope matter more than copying a familiar UUID-shaped snippet.

The 128-bit layout

A UUID is 32 hexadecimal digits in 8-4-4-4-12 groups. v4 fixes four version bits to 0100 and variant high bits to 10, leaving 122 random bits.

Hyphens and hexadecimal case do not change entropy.

xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
4 = version 4; y begins with variant bits 10

Secure browser generation

crypto.randomUUID() directly returns a v4 UUID. A fallback fills 16 bytes with crypto.getRandomValues, then masks version and variant bits.

Math.random is not designed for security and may have far less state, so it should not generate identifiers whose collision or unpredictability properties matter.

const b = crypto.getRandomValues(new Uint8Array(16));
b[6] = (b[6] & 0x0f) | 0x40;
b[8] = (b[8] & 0x3f) | 0x80;

How large is 122 bits?

The space contains 2^122 values, about 5.3 × 10^36. Matching one particular UUID is about one chance in that number.

For n generated values, the small-probability birthday approximation is p ≈ n(n−1)/(2 × 2^122). One billion ideal UUIDs still gives roughly 9.4 × 10^-20.

Real failures beat random collisions

Broken RNG seeding, deterministic test mocks, cloned machine state, implementation bugs, and truncation can dominate the ideal collision risk.

Never shorten a UUID without recalculating the new random space and expected scale.

Databases still need uniqueness

Use a unique index and retry the exceptionally rare conflict. This also catches duplicate imports and accidental reuse.

A random ID is not authorization. It may resist enumeration, but access checks must remain independent.

v4 versus v7

v4 is random and not naturally ordered. v7 combines Unix-millisecond high bits with randomness, improving sort locality for many databases.

Choose based on ordering, index behavior, information exposure, and ecosystem support.

Key takeaways

UUID v4 works because 122 high-quality random bits create a vast space, not because collision is impossible. Use browser crypto, keep all bits, enforce uniqueness, and separate authorization.