Question 1

How random is a UUID v4, really?

Accepted Answer

A UUID v4 has 122 random bits (the other 6 are fixed to mark the version and variant), generated here with the browser's crypto.getRandomValues — a cryptographically secure source, not Math.random. The chance of two independently generated v4 UUIDs colliding is astronomically small, which is why they're safe to use as unique identifiers without checking a central registry.

Question 2

When should I use a random string instead of a UUID?

Accepted Answer

UUIDs follow a fixed 36-character format (8-4-4-4-12 hex digits) that's recognized by databases and APIs as an identifier type. A custom random string is better when you need a specific length, a specific character set (like hex-only for a token, or no symbols for a filename), or something shorter than a full UUID for a code or slug.

Question 3

Are these generated server-side or could someone intercept them?

Accepted Answer

Everything is generated locally in your browser using the Web Crypto API — nothing is sent to a server, logged, or transmitted anywhere, so there is nothing in transit to intercept.

Question 4

Should I use these for passwords or secret keys?

Accepted Answer

The randomness source is suitable for that, but for passwords specifically, use a password manager’s generator so it can also store the result securely; treat anything generated here as visible in your browser history and clipboard, and rotate/regenerate before relying on it for a production secret.

UUID & Random String Generator

UUID v4 anatomy

Common questions